Lose a list

Compilation: Bo Wen, Bai Lu Club living room

The security of digital assets has always been one of the oldest topics in the industry. As more and more traditional institutions enter the venue, how to keep the digital assets of users in the overgrown web3 world in the hacker, becoming a problem that the industry’s scale continues to expand must be solved.Essence

In 2024, the United States SEC approved the Bitcoin spot ETF, and Coinbase became the Bitcoin custodian of 8 ETF publishers, which greatly supported its income development.Digital asset custody is no longer just a technical issue, and it has also become a must -have business for power institutions.If Hong Kong wants to quickly catch up with the United States, it must also be accelerated in the supervision of digital asset custody.

On February 20, 2024, the Hong Kong Financial Administration (HKMA) issued a guidance on digital asset custody activities, List the relevant standards,Including governance and risk management, customer digital assets of digital assets, customer digital asset protection, commission and outsourcing, etc.Guidance provides institutions and subsidiaries for digital asset custody activities in Hong Kong.

The following is the preparation of the original text compilation.

The expected standard guidelines of digital asset custody service authorization agencies

This guidelines apply to digital assets held by the authorized agency (AIS) and their subsidiaries (that is, assets that mainly depend on cryptography and distributed ledger or similar technologies), which are registered locally, but do not include specific purposesDigital tokens.As a explanation, the assets cover include virtual assets (VA), tokens, and other token assets.This guidelines are not applicable to the custody of AIS or its own assets, and these assets do not represent customers.

(A) Governance and risk management

1. 1.Before the launch of digital asset custody services, the authorization agency should conduct a comprehensive risk assessment to identify and understand the relevant risks.Authorized agencies should establish appropriate policies, procedures and control measures, manage and reduce the risks of recognized, and consider applicable legal and regulatory requirements.The board of directors and senior management of the agency should effectively monitor the risk management process to ensure that they can identify, evaluate, manage, and reduce risks related to custody activities before and during these activities.

2.The authorized agency shall allocate sufficient resources for their custody activities, including necessary manpower and professional knowledge to ensure proper governance, operation and effective risk management.Advanced management and employees who participate in the institution’s digital asset storage activities and related control functions shall have the knowledge, skills and professional knowledge required to perform their duties.

3..In view of the rapid development of the digital assets, the authorization agency should ensure that it provides sufficient training for senior management and employees engaged in custody activities to maintain its continuous business capabilities.

4. 4..The authorization agency should establish appropriate accountability arrangements to the storage activities, including clearly written roles and responsibilities and report lines.There should also be sufficient policies and processes to identify, manage and reduce potential and/or actual interest conflicts of interest, such as conflicts that may occur between different activities conducted by institutions or related parties.

5.The authorized agency shall establish and maintain effective spare and disaster recovery arrangements to ensure the continuity of its custody activities.

(B) Isolation of customer digital assets

6.The authorized agency shall deposit customer digital assets in a special customer account separated from the institution’s own assets to ensure that the customer’s digital assets are exempt from institutional creditors when bankruptcy or dissolution.

7.The authorization agency shall not transfer any rights, interests, ownership, laws and/or actual ownership of the customer’s digital assets, nor should it be borrowed, mortgaged, mortgaged or sets any burden on customer digital assets.I) Settlement transactions, costs and charges of/or customer owed institutions; (ii) obtains the client’s premium consent in advance; or (III) law.The institution should take full and effective measures to prevent the use of customer digital assets for its own account or the purpose agreed with the customer.

(C) Protection of customer digital assets

8..A authorized agency should establish sufficient systems and controls to ensure that customer digital assets are timely and properly protected and fully protected.In particular, the agency should formulate effective control measures to minimize the risk of customer digital assets caused by the stolen, fraud, negligence or other occupation behaviors, and delayed access to customer digital assets.

9.When developing systems and controls to protect customer digital assets, the authorized agency can adopt risk -based methods to consider the nature, characteristics and risks of the digital assets of its custody.Risks may depend on the types of distributed ledger technology (DLT) network used (such as private permits, public permits, and non -licensing), as well as the relief measures.For example, the customer digital assets held on the public DLT network may face higher network security risks. The recovery of losing assets may be difficult when theft, hacker attack or other network attacks occur.There may be measures to control the DLT network on the DLT network of public licenses and private licenses.

10..The systems and controls used to protect customers’ digital assets include, but not limited to the written policies and procedures in the following aspects:

-Aligree and verification access to deposit, withdrawal and transfer of customer digital assets, including equipment that visits storage seeds and private keys; and

-The seeds and private keys to manage and protect customer digital assets, including key generation, distribution, storage, use, destruction and backup.

11.,In particular, it is expected that the authorized agencies will adopt the best practice of related industries and follow the applicable international security standards to meet the nature, characteristics and risks of the assets.Although the procedures and controls listed below are not designed to be standardized or one -size -fits -all, they usually require the authorization agencies to hold customers VA.For other digital assets, the authorization agency may use the risk -based method to perform the following procedures and controls, which is consistent with the risks faced. HoweverIn the form of form, the authorization agency should also be more cautious and conduct prudential assessment of implementation:

-In the production and storage of seeds and private keys in a safe and anti -tampered environment and equipment (such as hardware security module HSM), including their backup.In a feasible circumstances, seeds and private keys should be generated offline, and a proper life cycle limit should be set;

–Safety generation, storage and backup seeds and private keys are located in Hong Kong;

-The access permissions for encrypted devices or applications is limited to the authorized personnel according to needs. These personnel have been appropriately screening and training; maintained the latest document records and distribution of access to access methods;If multi -factor authentication, authentication of the interviews of seeds and private keys; maintaining audit tracking of encrypted devices or application access;

–By using key shards or similar technology to prevent any “single failure point”, for example, the private key is divided and distributed to the authorized authorized agencies to distribute it to ensure that no single party holds all the keys.Generally, a certain number of key shard holders need to sign a transaction collectively to ensure that no single person has complete access permissions, and at the same time, the operation is lost when a single shard is lost, unavailable or stolen.In order to prevent the “single failure point”, you can also consider using multiple wallets instead of a single wallet to hold customer digital assets;

–Establish measures to prevent and reduce the risk of collusion between authorized personnel with access to access to words and private key authorityItems

–For notes and private keys, sufficient differential backup and emergency arrangements should be formulated. These arrangements should be restricted by the same security control as the original notes and private keys.The backup notes and private keys should be stored in a safe physical location that has nothing to do with the main location of the storage original notes and the main location of the private key and will not be affected by any event;

-In unless otherwise proves, most customers should be preserved in the cold storage that is not connected to the Internet; most customer digital assets are preserved;

-Sther by passing the wallet address that belongs to the customer (for example, through the ownership test, such as message signature or micro -payment test), it has already been included in the whitelist to allow customers to deposit and withdraw from digital assets;

-Che measures to ensure that any smart contract used during the hosting process is largely not affected by contract vulnerabilities or security defects; and

-Forming appropriate insurance or compensation arrangements, fully covered the customer’s digital asset losses due to hackers, theft or fraud (whether due to the behavior, errors, negligence, or major negligence of the authorized agency.

12,.When the authorization agency provides customers with user interface or portal to manage digital assets held by the authorized agency, effective customer identity verification and notification control measures shall be established to follow the relevant guidance policy formulated by the Hong Kong Financial Administration (HKMA) from time to time.

13.The authorization agency should pay close attention to the trend and development of emerging and security threats, loopholes, attacks and fraud risks, and the trend and development of technical solutions; regularly evaluate the sufficientness and robustness of security risk control, consider emerging threats and technological progress; and take measures, according to the relevant relevant measureThe industry’s best practice and applicable international standards, the technology of custody customer digital assets is adopted.Before deploying, testing the wallet storage technology used to keep the customer’s digital assets for testing to ensure its reliability.

(D) commission and outsourcing

14.As a general principle, in terms of virtual assets, the authorized agency can only entrust its custody function to (i) another authorized agency (or a subsidiary of a registered authorized agency registered locally);Virtual asset trading platform for the license.For other digital assets that are unprecedented token, if they are located on the public-unauthorized distributed ledger network, the authorized agency should be particularly cautious and conduct in-depth evaluation whether to appropriately entrust or outsourcing its custody functions.

15.When a authorized agency reaches a commission or outsourcing arrangement with the commissioner or service provider in terms of providing digital asset custody services, the authorized agency shall conduct appropriate due diligence before selecting and appointing the entrusting or service provider.The authorized agency shall evaluate and ensure satisfaction, including but not limited to the financial and healthy status, reputation, management skills, technology and operating capabilities of the client or service provider, as well as the ability and capabilities that meet the applications and other applicable laws and regulatory requirements, as well asKeep up with technological development in the field of digital assets.Due to due diligence and evaluation and results should be preserved with appropriate records.Authorized agencies should establish effective control measures to continuously monitor the performance of the commissioner or service provider.

16.When providing digital asset custody services with the commissioner or service provider, the authorized agency should have technical expertise to evaluate the effectiveness of the deployment solution in protecting customers’ digital assets, and whether it introduces any single failure points.The authorized agency should also fully understand the terms and conditions of the client or service provider holding the customer’s digital assets, and evaluate whether it will have a significant impact on the legal rights of customers when the entrusting party or service provider bankruptcy.The authorization agency is responsible for ensuring that the commissioner or service provider appropriately isolated customer digital assets in accordance with paragraphs 6 and 7 of this attachment.

17.Emergency and disaster recovery arrangements for authorization agencies should cover the interruption of interruptions caused by commissioned or outsourcing digital asset custody services.The authorized agency should also evaluate the elasticity of the commissioner or service provider, including its emergency plans and procedures to ensure the availability of the hosting service.

18.Remind the authorization agency in the commission or outsourcing arrangement of digital asset custody services, and also maintains the corresponding system and control with the commission or outsourcing arrangement of traditional financial activities.

19.The final responsibility and accountability system of any commissioned or outsourcing activities shall be borne by the authorized agency.

(E) Risk disclosure

20.The authorization agency shall fully and fairly disclose the custody arrangements to its customers in a clear and easy -to -understand way, including:

-The rights and obligations of the authorized agency and their customers, including the ownership of the customer’s ownership of their assets when the authorized agency enters the bankruptcy or liquidation;

-The hosting arrangement, including the storage and isolation methods of customer digital assets, procedures and time to access customer digital assets, and any applicable costs and costs;

-A compensation arrangements, covering customer digital asset losses that may be caused by safety events or misappropriation;

-The client digital assets and other customer assets are mixed, as well as related risks;

-The authority will obtain the statutory and/or beneficial ownership of customer digital assets in it, or transfer, borrow, mortgage, re -mortgage or set any guarantee for customer digital assets in other ways, and the risks involved;

-The approach of customer digital assets in voting, hard fork and airdrops, as well as their corresponding rights and rights;

-Aligible agencies shall comprehensively and fairly disclose their hosting arrangements to their customers, including potential and/or actual interests related to their hosting activities.

(F) Records of customer digital assets preservation and reconciliation

twenty one.The authorization agency shall maintain proper account books and records for each customer to track and record ownership of customer digital assets, including the amount and type of assets owed to customers, and the flow of assets between customer accounts.The customer’s digital assets should be paid regularly and frequently on the basis of customers, considering the relevant chain and chain records.If there is any inconsistency, it should be resolved in a timely manner and upgraded to advanced management in a timely manner.

twenty two.The authorization agency shall establish systems and control measures to keep and protect all records related to custody activities, and shall provide timely timely timely providing these records at the Hong Kong Financial Administration.

(G) Anti -money laundering and cracking down on terrorist financing

twenty three.The authorized agency should ensure that its anti -money laundering and cracking down on terrorist financing (AML/CFT) policy, procedures and control can effectively manage and reduce any money laundering and terrorist activities related to digital asset custody activities.The authorized agency shall abide by the AML/CFT guidance documents of the “Anti -Money Laundering and Campaign of Financial Campaign Financing (Applicable to Authorized Institutions)” and the Hong Kong Financial Administration on digital asset custody activities.

(H) The requirements for continuous monitoring

twenty four.The authorization agency shall regularly review its policies and procedures, and conduct independent audit on its systems and controls, as well as the compliance requirements of the applicable requirements of customer digital asset storage.