A practical guide to a stablecoin or digital-asset custody arrangement

A digital-asset custody arrangement defines who holds the private keys, under what legal obligations, and through which regulatory perimeter – and in Hong Kong, the governing rules changed materially when the mandatory licensing regime for virtual-asset trading platforms commenced on 1 June 2023 under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Getting the structure right before assets are onboarded is the decision that shapes every downstream compliance, enforcement, and cross-border transfer question.

This guide sets out the practical sequence for in-house counsel and principals structuring a stablecoin or digital-asset custody arrangement through or connected to Hong Kong. It covers the decision points in order, the gate at each step, the most common structural error, and a short checklist before you proceed.

What decision does the custody arrangement actually resolve?

Custody of a digital asset is not merely a safekeeping question. It is a regulatory-status question, a governance question, and – for cross-border groups – a jurisdiction question, all at once.

The decision tree has three branches. First: who will hold the private keys? A self-custody model, a third-party custodian, or a sub-custody chain. Each carries a different regulatory exposure. Second: what type of asset is being held? A fiat-referenced stablecoin (a digital token pegged to a currency such as the Hong Kong dollar or the US dollar) sits in a different regulatory lane from a utility token or from a virtual asset that meets the definition of a "security" or "futures contract" under the Securities and Futures Ordinance. Third: where is the custodian? The answer to that question determines which regulator applies, which AML obligations attach, and whether the arrangement engages the Securities and Futures Commission (SFC), the Hong Kong Monetary Authority (HKMA), or both.

These three questions interact. A group that answers them sequentially – rather than together – typically discovers a structural problem only after it has onboarded assets or signed a services agreement.

What is the regulatory perimeter in Hong Kong?

The Hong Kong mandatory licensing regime for centralised virtual-asset trading platforms (VATPs) – entities that operate exchanges or provide custodial services as part of a trading platform – is administered by the SFC under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. The regime commenced on 1 June 2023 and mandatory licensing requirements apply to VATPs operating in or targeting Hong Kong.

Where the digital asset constitutes a "security" or "futures contract" as defined, the Securities and Futures Ordinance applies concurrently. That overlap is material: a group structuring an arrangement around a tokenised fund interest or a yield-bearing stablecoin may engage SFO licensing requirements on the custodian, not merely the VATP regime.

Fiat-referenced stablecoins sit in a separate lane. The HKMA has developed a licensing regime for fiat-referenced stablecoin issuers, with the regulatory perimeter commencing in 2025. Because commencement details and the exact scope of the issuer definition remain subject to active regulatory development, we advise verifying the current position directly before structuring any arrangement that involves issuing, holding, or redeeming a fiat-referenced stablecoin through a Hong Kong entity.

AML obligations run across both regimes. VATPs are subject to customer due diligence requirements and the FATF travel rule (the Financial Action Task Force standard requiring originator and beneficiary information to accompany virtual-asset transfers above a threshold). That rule applies to cross-border transfers and to transfers between VATPs within Hong Kong. A custody arrangement that routes assets through a VATP – even as a technical sub-custodian step – brings the travel-rule obligations into the structure.

How does the cross-border element change the structure?

The cross-border element is the axis on which most custody arrangements either hold or fracture. A group with a Cayman or BVI holding entity above a Hong Kong operating entity, or with counterparties and asset pools in the UAE, Singapore, or the Mainland, faces a layered compliance picture that no single jurisdiction resolves on its own.

Consider a mid-market corporate treasury using a stablecoin position held at a VATP in Hong Kong, with the beneficial owner sitting in a Cayman fund structure. The VATP's AML obligations run to the Hong Kong regulatory perimeter. The Cayman structure carries its own economic-substance and AML requirements under the offshore regime. The fund's investor disclosure obligations may engage the SFO if the stablecoin is a security. Each layer requires its own analysis; assuming that compliance in one jurisdiction satisfies the others is the structural error we see most frequently in our cross-border practice.

For groups with Mainland China exposure, a separate question arises: the Mainland does not currently permit VATPs to operate for Mainland residents, and the legal treatment of digital assets under PRC law is materially different from the Hong Kong position. A custody arrangement that sits in Hong Kong but is beneficially controlled or economically connected to a Mainland entity requires careful analysis of the control and beneficial-ownership chain before the structure is confirmed.

Our desk regularly advises on this Hong Kong – offshore (BVI / Cayman / UAE) interface. See our analysis of a digital-asset fund structured through Hong Kong and the UAE for a worked example of how this layering operates in practice.

What is the practical sequence? A step-by-step guide

The sequence below applies whether the arrangement is a pure custody play or part of a broader issuance, trading, or fund structure. Each step has a gate – a binary question that determines whether you move forward or re-examine the design.

Step 1 – Asset classification. Identify the legal nature of the asset. Is it a security or futures contract under the Securities and Futures Ordinance? A fiat-referenced stablecoin that may fall within the HKMA issuer perimeter? A utility token outside both regulatory lanes? The classification determines which regime governs and which licences are required of the custodian. Gate: if classification is ambiguous, obtain a written position before onboarding.

Step 2 – Custodian and licensing review. Identify the proposed custodian. Where it is a VATP or sub-custodian operating in or from Hong Kong, confirm its licensing status under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance. Where the asset may be a security, confirm whether an SFO licence is also required for the custodian to hold that asset on behalf of the client. Gate: do not onboard assets to an unlicensed custodian; the licensing obligation runs to the custodian's conduct, not merely to the client's intent.

Step 3 – Ownership and governance structure. Document the control and beneficial-ownership chain. This is the AML file, not merely a corporate-governance step. The travel rule requires that originator and beneficiary information accompany transfers; a custody arrangement that cannot produce a clear beneficial-ownership chain at the point of each transfer will stall or be rejected by a compliant VATP. Gate: the AML file must be complete before the first transfer, not assembled retrospectively.

Step 4 – Custody agreement drafting. The custody agreement governs the key relationship. It should address: the custodian's segregation obligations (client assets from proprietary assets); the key-management protocol (who holds signing keys, what is the threshold for a transaction, what happens on the custodian's insolvency); liability for cyber incidents and loss; and the governing law and dispute resolution clause. For a cross-border arrangement, the choice of governing law and the enforcement route for the custody agreement are decisions with real consequence. Gate: do not rely on the custodian's standard terms without review; those terms are drafted to limit custodian liability, not to protect the client's position.

Step 5 – Ongoing AML and travel-rule compliance. Once the arrangement is operational, the AML obligations are continuous. The travel rule applies to each qualifying transfer. Customer due diligence obligations require periodic refresh. For fiat-referenced stablecoins, verify whether the HKMA regime imposes additional reporting or reserve-transparency obligations on the issuer and whether those flow through to the holder. Gate: compliance is not a point-in-time sign-off; build a review cycle into the arrangement from the start.

Step 6 – Cross-border transfer and enforcement readiness. If the group may need to move assets across jurisdictions – from Hong Kong to the Mainland, to the UAE, or into an offshore fund structure – map the transfer route before it is needed. Enforcement of claims against a custodian in a cross-border context raises questions about the applicable law, the recognition of Hong Kong judgments or awards in the custodian's home jurisdiction, and the availability of interim measures. For Hong Kong-seated disputes, the HKIAC Administered Arbitration Rules (in force from 1 June 2024) and the interim-measures Arrangement between Hong Kong and the Mainland (in effect since 1 October 2019) are relevant tools. Gate: confirm the enforcement route is workable before the arrangement is signed.

The sequence above describes the standard position. Your matter turns on the documents, the asset type, the custodian's jurisdictional reach, and the order of steps – which is where the route is won or lost. To discuss how this sequence applies to your arrangement, contact info@lockhartyip.com.

What do foreign or offshore groups get wrong?

The most consistent structural error we see is treating the Hong Kong custody arrangement as a back-office function and engaging legal review only after the commercial terms have been agreed. By that point, the asset classification has not been documented, the custodian's licence status has not been verified, and the AML file is a gap in the transaction record rather than a foundation for it.

A second error is assuming that a custodian licensed or regulated elsewhere – in the UAE, Singapore, or the EU – carries its compliance posture automatically into a Hong Kong-connected arrangement. It does not. The Hong Kong regulatory perimeter is self-contained. Where the arrangement has a Hong Kong nexus – a Hong Kong entity in the ownership chain, a VATP operating in Hong Kong, or a counterparty subject to Hong Kong law – the Hong Kong requirements apply independently of what the custodian does or does not do in its home jurisdiction.

A third error, specific to stablecoins, is treating the fiat-referenced stablecoin as legally equivalent to a bank deposit or a money-market instrument for custody and AML purposes. It is not. The HKMA regime and the VATP regime create a distinct regulatory space for stablecoin holding and transfer, and the obligations that attach to the custodian and the client are not identical to the obligations that attach to a conventional cash custodian.

If an earlier structure or onboarding produced a stalled compliance file, a blocked transfer, or a regulatory query, a second read can identify the structural gap and the steps still open. Write to info@lockhartyip.com with the background and we will assess the position.

How does this connect to the broader Tech & Web3 practice?

A custody arrangement rarely sits in isolation. For a group building or operating a digital-asset business through Hong Kong, the custody structure intersects with the licensing strategy (VATP, SFO, and potentially HKMA stablecoin), the AML and sanctions compliance programme, the entity structure above the operating company, and the fund or treasury management arrangements below it.

In our Tech & Web3 practice, we regularly act on the intersection of licensing posture, entity structure, and cross-border AML compliance. We review the custody and licensing position, structure the entity chain across Hong Kong and the relevant offshore centres, and prepare the regulatory engagement steps. For groups at an earlier stage, the cross-border SaaS and data agreement analysis available at our guide on cross-border SaaS and data agreements sets out how data and operational agreements interact with the regulatory perimeter. See also our broader Tech & Web3 practice overview for the full service scope.

The sanctions dimension is also relevant for groups with exposure to restricted jurisdictions or counterparties. Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. A custody arrangement that routes stablecoin transfers through a Hong Kong VATP must be assessed for UN-sanctions compliance on each transfer; the travel rule documentation supports but does not replace that assessment.

Decision checklist before you proceed

The following questions function as a gate-review before signing any custody arrangement or onboarding assets. A "no" or "unclear" answer at any point is a signal to pause and obtain advice.

• Has the asset been classified – security, futures contract, fiat-referenced stablecoin, or other virtual asset – and has that classification been documented in writing?
• Has the custodian's licence status been verified under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (VATP licence) and, where relevant, under the Securities and Futures Ordinance?
• Has the beneficial-ownership chain been documented to the standard required by the custodian's AML obligations and the FATF travel rule?
• Has the custody agreement been reviewed – not the custodian's standard terms, but a version that addresses segregation, key management, insolvency protections, and the governing law and dispute-resolution clause?
• Has the cross-border transfer route been mapped, including the enforcement position if the custodian fails to perform?
• For fiat-referenced stablecoins: has the current commencement position and perimeter of the HKMA stablecoin issuer regime been verified?
• Has a compliance-review cycle been built into the operational arrangement from the outset?

For a structured assessment of your custody arrangement across the relevant jurisdictions, write to us at info@lockhartyip.com.

Related practices

• Sanctions & AML – AML compliance, travel-rule obligations, and sanctions-neutral contracting for digital-asset groups
• Holding Structures – entity design across Hong Kong, BVI, Cayman, and the principal offshore centres for digital-asset businesses

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

Related

• Tech Web3
• Digital Asset Fund Structured Through Hong Kong Uae 4
• Cross Border Saas Or Data Agreement Touching Cyprus 3

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.