Updated Guidance on Expected Standards on Provision of Custodial Services for Digital Assets by Authorized Institutions

55th Floor, Two International Finance Centre, 香 港 中 環 金 融 街 8 號 國 際 金 融 中 心 2 期 55 樓 8 Finance Street, Central, Hong Kong 網 址：www.hkma.gov.hk Website: www.hkma.gov.hk Our Ref: B1/15C G16/1C 27 May 2026 The Chief Executive All Authorized Institutions Dear Sir / Madam, Updated Guidance on Provision of Custodial Services for Digital Assets The rapid development of the digital asset ecosystem has prompted growing demand for custodial services for digital assets1 . Recognising the market and technological developments in safeguarding clients’ digital assets, including the implemenation of the Stablecoins Ordinance (Cap. 656), the Hong Kong Monetary Authority (“HKMA”) has reviewed and updated its guidance on the provision of digital asset custodial services for clients by authorized institutions (“AIs”). The updated guidance underscores the importance of robust security, governance, and operational controls to ensure that client digital assets held by AIs in custody are adequately safeguarded and that the risks involved are properly managed. With reference to international standards and emerging industry practices, the HKMA has refined the expected standards in the Annex, which have incorporated flexibility for AIs to put in place operational arrangements that are commensurate with the nature, features and risks of the digital assets under custody. AIs should apply these standards in safeguarding client digital assets, whether the assets are received in the course of conducting virtual asset-related activities as an 1 For the purpose of this circular, the term “digital assets” refers to digital assets that depend primarily on cryptography and distributed ledger or similar technology, such as virtual assets as defined in section 53ZRA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), tokenised securities and other tokenised assets. The term “digital assets” should be read to also cover the means of access to a digital asset, which generally refers to private keys, seeds or their backups. Limited purpose digital token, as defined in section 53ZR of the AMLO, is excluded from the scope of this circular. This circular is not applicable to custody of proprietary assets of the AI or its group companies which are not held on behalf of clients.

• 2 - intermediary2 , distributing tokenised products, or providing standalone custodial services. In addition to the expected standards set out in the Annex, AIs are reminded to also comply with all the applicable legal and regulatory requirements when providing digital asset custodial services. This circular applies to AIs and subsidiaries of locally incorporated AIs that conduct digital asset custodial activities. The locally incorporated AIs should ensure that the business conduct, practices and controls of such subsidiaries comply with this circular and the Annex. Implementation AIs which by themselves or (in the case of locally incorporated AIs) whose subsidiaries intend to provide digital asset custodial services should discuss with the HKMA in advance and demonstrate to the satisfaction of the HKMA that they meet the expected standards and requirements in this circular (as amended from time to time). AIs or subsidiaries of locally incorporated AIs already engaging in digital asset custodial activities should review and revise as necessary their systems and controls, to ensure that they meet the latest expected standards in the Annex. The HKMA will keep in view the evolving digital asset market and international regulatory landscape, and may provide further guidance as and when necessary. This circular supersedes the HKMA’s circular dated 20 February 2024 on “Provision of Custodial Services for Digital Assets”. Should you have any questions regarding this circular, please contact Mr Adam Tse at 2878 1233 or Ms Hoi Yan Tseung at 2878-1408. 2 See “Joint circular on intermediaries’ virtual asset-related activities” issued by the HKMA and the Securities and Futures Commission (last updated on 22 December 2023) and further guidance issued by the HKMA and the SFC from time to time, including the “Supplemental joint circular on intermediaries’ virtual asset-related activities” issued on 30 September 2025 and the HKMA’s circular on “Virtual asset￾related activities in relation to relevant stablecoins issued by licensed stablecoin issuers” issued on 27 May 2026 respectively.

• 3 - Yours faithfully, Alan Au Executive Director (Banking Conduct) Encl. c.c. Securities and Futures Commission (Attn: Dr Eric Yip, Executive Director, Intermediaries)