How to approach a stablecoin or digital-asset custody

Digital-asset custody is no longer a technical afterthought. For a group holding fiat-referenced stablecoins or other virtual assets through a Hong Kong structure, the custody arrangement is a legal and regulatory decision – one that interacts with licensing obligations, anti-money laundering rules and the broader question of where accountability sits when something goes wrong. The choice of custodian, the jurisdiction of the custodian, and the contractual terms governing the arrangement each carry distinct legal consequences. Getting the sequence right matters from day one.

Approaching a stablecoin or digital-asset custody arrangement in Hong Kong requires the principal to work through four gates in order: regulatory classification, custodian due diligence, contractual structure, and ongoing AML and compliance obligations. The governing instruments are the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, the Securities and Futures Ordinance where a virtual asset is a "security" or "futures contract", and – for fiat-referenced stablecoin issuers – the Hong Kong Monetary Authority licensing regime that commenced in 2025. The sequence is not interchangeable. A principal who skips the classification gate and moves directly to contracting may find that the arrangement is unenforceable or, worse, that the custodian is operating outside a required licence.

This guide walks through the decision in order: the initial classification question, the regulatory gate, the due-diligence and structuring steps, the contractual points that determine accountability, and the ongoing compliance obligations. Each section identifies the gate the reader must pass before moving to the next step.

What decision does the principal actually face?

The starting point is not which custodian to choose. It is whether the assets in question require a regulated custody arrangement at all, and if so, which regulator is engaged. That question turns on what the assets are, who is holding them, and in which capacity.

In the Hong Kong context, virtual assets fall into at least two distinct regulatory lanes. Where a virtual asset constitutes a "security" or "futures contract" as defined under the Securities and Futures Ordinance, the Securities and Futures Commission (the SFC, Hong Kong's primary securities and markets regulator) has jurisdiction over the activity. Where a virtual asset does not meet that definition – a category sometimes described as a non-securities virtual asset – the mandatory licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, which commenced 1 June 2023, applies to centralised virtual-asset trading platforms, or VATPs (platforms that provide exchange services in virtual assets to the public). The SFC is the licensing authority for VATPs as well.

Fiat-referenced stablecoins introduce a third lane. The Hong Kong Monetary Authority, or HKMA, is building a licensing regime for fiat-referenced stablecoin issuers (entities that issue tokens whose value is pegged to one or more fiat currencies). That regime commenced in 2025; parties should verify the current commencement date and the precise scope of the perimeter before relying on any specific feature of it. The custody of fiat-referenced stablecoins does not automatically place the custodian under the HKMA regime, but the issuer relationship creates obligations that flow downstream to custody arrangements.

The principal therefore faces a three-part question before any commercial discussion begins: What is the regulatory classification of the asset? Which regulator is engaged, or potentially engaged? And does the custody arrangement itself trigger a licensing obligation on the custodian or on the principal's own entity?

Step 1 – Regulatory classification: the gate that determines everything else

Classification is the gate that determines every subsequent step. Pass it correctly and the rest of the sequence becomes tractable. Treat it as a formality and the entire structure is exposed to regulatory risk from the outset.

The classification analysis for a virtual asset in Hong Kong runs in sequence. First: does the asset constitute a "security" under the Securities and Futures Ordinance? This is a functional test. An asset that carries rights equivalent to equity or debt – profit participation, a claim against an issuer, governance rights over an enterprise – is likely to be a security regardless of the technology used to represent it. If it is, custody of that asset engages SFC-regulated activity. An entity providing custody of securities requires authorisation.

Second: is the asset a fiat-referenced stablecoin? If so, the HKMA perimeter is potentially engaged, particularly if the principal's entity is involved in issuance, distribution or redemption. Custody of such an instrument requires specific contractual and structural protections to address the redemption-risk exposure that flows from holding a token whose value depends on the issuer's reserve management.

Third: does the asset fall outside both of the above? A non-securities virtual asset held by a VATP still engages the Anti-Money Laundering and Counter-Terrorist Financing Ordinance regime, including customer due diligence and the FATF travel rule (the Financial Action Task Force requirement that identifying information accompany virtual-asset transfers above a prescribed threshold).

In our cross-border practice, the classification error we see most frequently is the assumption that a token labelled a "utility token" by its issuer is automatically outside the securities perimeter. The label is not the test. The functional rights attached to the token are. A principal whose holding entity sits in Hong Kong and whose custodian is offshore cannot rely on the offshore label to override Hong Kong's classification analysis if the activity is Hong Kong-connected.

Step 2 – Custodian due diligence: licensing posture and the cross-border interface

Once classification is established, the next gate is the licensing status of the proposed custodian. This step is non-negotiable. Placing assets with an unlicensed custodian where a licence is required creates regulatory exposure for the custodian and, depending on the circumstances, for the principal as well.

For a Hong Kong-connected arrangement, the due-diligence inquiry has two arms. The first is whether the custodian holds, or has applied for, the relevant licence or registration from the SFC under the mandatory VATP regime or under the Securities and Futures Ordinance. A platform that commenced operations before 1 June 2023 may have relied on transitional provisions; those transitional windows are time-limited and parties should verify whether the custodian's status has been regularised.

The second arm is cross-border: where the custodian is incorporated or licensed offshore – in the Cayman Islands, the British Virgin Islands, or another centre frequently used above Hong Kong operating entities – the question is whether that offshore entity's activities are nevertheless subject to Hong Kong regulatory oversight by reason of the connection to Hong Kong. The SFC has maintained a broad jurisdictional reach over activities that, while conducted from offshore, produce effects in Hong Kong or involve Hong Kong-based investors or principals.

A principal whose group uses a BVI or Cayman holding entity above a Hong Kong operating company cannot assume that placing custody of virtual assets at the BVI or Cayman level removes the arrangement from Hong Kong regulatory scrutiny. Counsel on our desk regularly advise on exactly this point. The substance of the activity – where decisions are made, where assets are accessed, where instructions are given – governs the analysis, not the jurisdiction of incorporation of the entity named as the account-holder.

The due-diligence file at this stage should include: the custodian's current regulatory status (licence number if applicable, regulator, scope of licence); the jurisdictions in which the custodian is authorised to operate; the custodian's AML and customer due diligence procedures; and the custodian's insurance or indemnity arrangements covering loss of digital assets. That last point is often absent from the first draft of any due-diligence checklist and is consistently the most consequential gap.

For a structured assessment of your cross-border custodian due-diligence position and the licensing obligations that apply to your Hong Kong structure, write to us at info@lockhartyip.com.

Step 3 – Contractual structure: where accountability is actually allocated

The custody agreement is the document that allocates accountability when assets are lost, frozen, or made subject to a regulatory action. Principals who treat it as a standard-form document – signed without negotiation – commonly discover the gap only after a problem has arisen.

The key structural questions in a digital-asset custody agreement are: (a) whether the arrangement is a custodial arrangement (the custodian holds title or control on behalf of the principal, with a clear obligation to return equivalent assets) or a sub-custodial chain (assets pass through multiple entities before reaching the vault); (b) how the private keys are held and by whom – self-custody (the principal retains the keys), third-party custody (keys held entirely by the custodian), or a multi-signature arrangement (authorisation split between the principal and the custodian); (c) the standard of care and the loss-allocation provisions, including whether loss arising from a cyberattack, an insider breach, or a regulatory freeze is at the custodian's risk or the principal's; and (d) the governing law and dispute resolution clause.

On governing law: a custody agreement that names Hong Kong law as the governing law brings the dispute into the Hong Kong courts, a common-law system with English as an official working language and a well-developed body of commercial law. That is generally favourable for a principal seeking certainty and enforceability. An arbitration clause – submitted to the HKIAC (Hong Kong International Arbitration Centre) under the HKIAC Administered Arbitration Rules – adds a layer of confidentiality and provides an award that may be enforced across a wide range of jurisdictions. The 2024 Rules, effective 1 June 2024, are the current operative version.

A cross-border custody arrangement – for example, a Cayman-incorporated fund holding stablecoins through a Hong Kong-licensed custodian – requires additional provisions addressing which jurisdiction's insolvency rules govern the return of assets if the custodian fails. Hong Kong insolvency law and Cayman insolvency law handle the rights of custody clients differently; the gap between them can be significant. The agreement should address this explicitly.

The common mistake at this stage is treating the governing-law and dispute-resolution clause as a commercial afterthought. It is not. It is the provision that determines whether the principal can actually enforce its rights when the custodian's obligations are disputed or when the custodian fails. We have acted on cross-border custody disputes where the absence of a clear governing-law and seat-of-arbitration clause produced an enforcement impasse that would have been avoided by one additional line in the original agreement.

How does the AML and travel-rule obligation affect the custody arrangement?

The Anti-Money Laundering and Counter-Terrorist Financing Ordinance imposes customer due diligence, record-keeping and reporting obligations on regulated entities in Hong Kong, including VATPs. The FATF travel rule – requiring that originator and beneficiary information accompany virtual-asset transfers – applies to VATPs under Hong Kong's regime. Both obligations flow into the custody arrangement in practical terms.

For the principal, the AML implication is that a Hong Kong-licensed custodian will conduct, and periodically refresh, customer due diligence on the principal and on any beneficial owners of the principal's entity. The Significant Controllers Register requirement – in force since 1 March 2018 under the Companies Ordinance (Cap. 622) – means that a Hong Kong-incorporated entity must maintain a register of its significant controllers. That register is a source document for the custodian's AML process. Gaps in beneficial-ownership disclosure at the corporate level create friction at the custodian-onboarding stage and, in more serious cases, can result in refusal of the custody relationship.

For a custody arrangement involving a fiat-referenced stablecoin, the AML analysis extends to the source of funds used to acquire the stablecoin and, where the arrangement involves redemption, the destination of the fiat currency upon redemption. A custodian that cannot satisfy itself as to the source and destination of funds will decline or terminate the arrangement. The principal's AML file – source-of-funds documentation (evidence that the assets originate from identified, legitimate activity) – should be prepared before the custodian onboarding process begins, not during it.

The travel rule adds a transactional dimension. Each virtual-asset transfer above the prescribed threshold must be accompanied by identifying information about the originator and the beneficiary. A custody arrangement that involves regular transfers between wallets – including transfers between the principal's own wallets in different jurisdictions – must be structured to ensure that the travel-rule data flows alongside the transfer. In practice, this means confirming that both the sending and receiving VATPs use compatible travel-rule messaging systems. Where one party is offshore and the other is Hong Kong-licensed, technical compatibility is not guaranteed and should be verified before the arrangement is operationalised.

See also our Tech & Web3 practice overview for the broader regulatory context in which custody arrangements sit, and our briefings on cross-border data agreements touching the Cayman Islands and on cross-border arrangements touching Cyprus for related structuring considerations.

If an earlier onboarding process, a custody transfer or a regulatory inquiry has produced an adverse or stalled result, a structured review can identify the compliance gap and the routes still open. Write to us at info@lockhartyip.com to discuss your position.

Step 4 – Ongoing obligations: what the arrangement requires after signing

Signing the custody agreement and completing the initial AML onboarding does not conclude the compliance obligation. A digital-asset custody arrangement in Hong Kong has a continuing regulatory life that requires active management.

The first ongoing obligation is periodic AML refresh. A Hong Kong-licensed custodian is required to update its customer due diligence records when there is a material change in the principal's beneficial-ownership structure, the nature of the assets held, or the volume and pattern of transactions. A principal that reorganises its holding structure – for example, by substituting a new BVI entity as the account-holder – should anticipate a new onboarding cycle, not merely a notification. Failing to proactively manage the refresh process commonly results in a temporary suspension of the custody arrangement at an operationally inconvenient moment.

The second ongoing obligation is regulatory monitoring. The Hong Kong VATP regime is still consolidating. The HKMA stablecoin regime commenced in 2025 and its operational requirements are evolving. A custody arrangement that complied with the regulatory position at signing may require amendment as the perimeter is clarified or extended. Parties should build a periodic review clause into the custody agreement – an obligation on both parties to assess, at defined intervals, whether the arrangement continues to meet current regulatory requirements.

The third obligation is cross-border monitoring. A principal whose group operates across multiple jurisdictions – a common pattern for the groups that come to our desk, spanning Hong Kong, a Cayman or BVI holding entity, and an operating presence on the Mainland or in a Southeast Asian market – must track regulatory developments in each relevant jurisdiction. The travel-rule obligations of a Mainland-connected transfer differ from those of a Hong Kong-to-BVI transfer. A custody arrangement that does not build in a mechanism for cross-border regulatory updates will require ad hoc renegotiation each time a relevant jurisdiction changes its rules.

What does a foreign principal get wrong about the Hong Kong regulatory regime?

The most common error made by foreign principals – particularly those whose primary advisory relationship is with US or European counsel – is the assumption that a Hong Kong licensing analysis is substantially identical to the analysis they have already conducted in their home jurisdiction. It is not.

Hong Kong implements United Nations sanctions and does not give domestic effect to unilateral measures of other states. That is a factual, neutral position that creates a distinct compliance environment for groups structured through Hong Kong. A principal whose home-jurisdiction counsel has mapped the arrangement against US Office of Foreign Assets Control (OFAC) or EU sanctions lists should not assume that this analysis substitutes for a Hong Kong-specific assessment. The two analyses may reach different conclusions on the same counterparty.

The second error is the assumption that Hong Kong's regulatory regime for virtual assets is lighter than its counterparts in the United States, the European Union or Singapore. That was perhaps true at an earlier stage of the regime's development. It is not the current position. The mandatory VATP licensing regime, the HKMA stablecoin framework and the SFC's active supervision of the market represent a regime that is fully operative and is being enforced.

The third error – and in our cross-border experience, the most costly – is the failure to account for the interaction between the custody arrangement and the principal's Hong Kong corporate-tax position. A custody arrangement that generates income attributable to a Hong Kong entity may produce assessable profits under the territorial profits-tax system. The two-tier profits-tax rate – 8.25% on the first HK$2,000,000 of assessable profits and 16.5% above – applies to Hong Kong-sourced income. Whether income from a digital-asset custody arrangement is Hong Kong-sourced is a question that depends on where the relevant activity occurs, not where the custodian is licensed. Principals should take a tax position before the custody arrangement generates income, not after.

Decision checklist before entering a custody arrangement

The following checklist summarises the gates discussed in this guide. Each item is a necessary condition before proceeding to the next step. The list is indicative, not exhaustive, and the specific requirements of any arrangement will depend on the assets involved, the entities engaged and the jurisdictions connected.

Classification complete: the regulatory classification of each asset has been confirmed – securities virtual asset, fiat-referenced stablecoin, or non-securities virtual asset. The engaged regulator (SFC, HKMA, or both) has been identified.
Custodian licensed: the proposed custodian holds the current, operative licence or registration required for the asset class and the activity. Transitional-period status has been verified.
Cross-border jurisdiction mapped: the jurisdictions connected to the arrangement – by the custodian's incorporation, by the principal's holding structure, by the location of beneficial owners – have been identified and the regulatory perimeter in each has been assessed.
AML file prepared: source-of-funds documentation is ready before the onboarding process begins. Beneficial-ownership disclosures are current and consistent with the Significant Controllers Register.
Travel-rule compatibility confirmed: for arrangements involving transfers between VATPs, technical compatibility of travel-rule messaging systems has been verified on both sides.
Custody agreement negotiated: the key provisions – custody structure, private-key arrangement, standard of care, loss allocation, governing law, dispute resolution – have been reviewed and negotiated, not accepted on a standard-form basis.
Tax position taken: a preliminary assessment of the Hong Kong profits-tax position has been obtained, covering whether income from the arrangement is Hong Kong-sourced under the territorial system.
Periodic review mechanism in place: the custody agreement includes a mechanism for periodic regulatory review, with defined triggers for amendment if the regulatory position changes.

Related practices

Tech & Web3 – licensing, AML and structuring for virtual-asset and technology groups with a Hong Kong or cross-border connection
Sanctions & AML – source-of-funds files, counterparty review and compliance documentation for cross-border transactions
Holding Structures – offshore and Hong Kong holding-entity design above digital-asset operating entities

Frequently asked questions

How does the cross-border element affect a stablecoin or digital-asset custody arrangement?

A cross-border custody arrangement requires a jurisdiction-by-jurisdiction analysis of regulatory classification, licensing and AML obligations. Where the custodian is licensed offshore but the principal's entity is Hong Kong-connected, Hong Kong's regulatory perimeter – including the mandatory VATP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance – may apply to the activity regardless of where the custodian is incorporated. The governing law and dispute-resolution provisions in the custody agreement determine which court or tribunal resolves a dispute about the arrangement, making that choice a substantive – not merely commercial – decision. Parties should also verify the travel-rule compatibility of the systems used by each VATP in the transfer chain.

What are the main risks in a stablecoin or digital-asset custody arrangement?

The main risks fall into four categories. Regulatory risk arises where the custodian is not properly licensed or where the arrangement triggers an obligation that has not been addressed. Contractual risk arises from inadequate loss-allocation provisions, particularly for losses arising from cyberattack, insider breach or a regulatory freeze. AML risk arises from gaps in source-of-funds documentation or incomplete beneficial-ownership disclosure. Insolvency risk arises where the custody agreement does not address which jurisdiction's rules govern asset return if the custodian fails. Each of these risks is manageable with the right prior structuring.

What is the first step in a stablecoin or digital-asset custody arrangement?

The first step is regulatory classification: determining the legal character of each asset in the arrangement and identifying which regulator – the SFC, the HKMA, or both – has jurisdiction over the custody activity. This step cannot be skipped or deferred. A principal that proceeds to custodian selection or contract negotiation before completing the classification analysis may find that the entire arrangement requires restructuring once the regulatory position is understood. Classification governs every subsequent gate in the process.

Speak with Lockhart & Yip

For a scoped view of your matter, contact info@lockhartyip.com. Discuss your matter →

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@lockhartyip.com.

How to approach a stablecoin or digital-asset custody arrangement