jakiro
Author: Zhang Feng
HashKey Group (hereinafter referred to as “HashKey”), as Asia’s leading compliant digital asset platform, systematically elaborates on its customer asset protection mechanism in its prospectus, especially the legal structure of encrypted asset custody, risk isolation arrangements, and asset ownership issues in extreme situations (such as platform bankruptcy).
1. Basic mechanism
HashKey regards “compliance, security, and trustworthiness” as its core operating philosophy, and has built a multi-layered protection system especially in terms of customer asset protection.According to the prospectus, its customer asset protection mechanism mainly includes the following aspects.
Licensed custody and compliance operations.HashKey provides institutional-grade digital asset custody services in Hong Kong through its licensed subsidiary HashKey Custody Services Limited.This service has obtained relevant licenses from the Hong Kong Securities and Futures Commission (SFC) and complies with the regulatory requirements for virtual asset service providers (VASP) under the Securities and Futures Ordinance.All business on the platform is conducted through licensed entities to ensure operations within the legal framework.
Hot and cold wallet tiered storage and SFC compliance.According to pages 28 and 34-35 of the prospectus, HashKey uses a combination of hot and cold wallets to store customer digital assets:
cold wallet,At least 98% of customer digital assets are stored in offline cold wallets, protected through multi-signature and hardware security modules (HSM), and private keys are kept in a physically isolated environment.
hot wallet,No more than 2% of assets are stored in hot wallets for daily operations and transaction settlement, and are also protected by multiple risk control measures.
This ratio is in line with the requirement that “the vast majority of customer assets should be stored in cold wallets” in the “Guidelines Applicable to Virtual Asset Trading Platform Operators” issued by the Hong Kong Securities and Futures Commission in 2023, reflecting its strict compliance with regulatory standards.
Asset segregation and trust structures.HashKey repeatedly emphasized in its prospectus that “customer assets are completely isolated from the platform’s own assets.”Specifically:
Legal currency funds,Customers’ legal currency funds are deposited in independent trust accounts of licensed banks (such as Standard Chartered Bank and Zhongan Bank). The account is opened in the name of the customer, and the legal ownership of the funds does not belong to HashKey.
digital assets,Customer digital assets are stored in isolated custody wallets, kept by the licensed custody entity HashKey Custody Services Limited, and are strictly separated from the platform’s own operating wallets.
This arrangement is similar to the “Client Asset Segregation” principle in traditional finance, which aims to prevent the platform from misappropriating customer assets and also lays the foundation for asset confirmation in bankruptcy scenarios.
Insurance and risk hedging.HashKey has purchased digital asset wallet insurance for managed assets, covering cold wallets and hot wallets. The insurance coverage includes risks such as theft and hacker attacks.The prospectus pointed out that its insurance rates showed a downward trend during the renewal cycle, reflecting the insurance institution’s recognition of its risk management capabilities.In addition, the platform has never experienced any loss of customer assets due to security vulnerabilities, nor has there been any on-chain confiscation events, which further reflects its safe operation record.
Technical and administrative control.It adopts technical means such as multi-signature, HSM, and automated monitoring systems; establishes a strict internal approval process and separation of duties mechanism; and has passed international certifications such as SOC 1 Type 2, SOC 2 Type 2, ISO27001 (information security management), and ISO27701 (privacy information management).
2. Basic structure
Judging from the prospectus, HashKey’s custody services are mainly provided by its licensed subsidiary HashKey Custody Services Limited, which is an “internal custody” model rather than a completely independent third-party custody.Nonetheless, it enhances the legal credibility of the hosting in the following ways.
Licensed entities operate independently.The custody business is independently carried out by a licensed legal entity, with an independent compliance team, risk control system and audit process, and is legally isolated from other businesses of the trading platform.
Bank cooperation is embedded in the trust structure.Legal currency funds are held in trust form through cooperative banks, and the bank assumes the responsibility for fund custody as a trustee, which introduces third-party supervision to a certain extent.
External audit and certification.Regularly conduct SOC and other assurance audits by third-party audit institutions to ensure the effectiveness of custody internal controls.
However, compared with purely independent third-party custodians (such as Coinbase Custody, Fireblocks, etc.), HashKey’s “internal custody” model still has a certain degree of “self-regulation and self-regulation” risk in form, although it is mitigated through strict regulatory compliance and external audits.
3. Asset protection
If the platform falls into bankruptcy, whether customers can get back their virtual assets first is the key to measuring the effectiveness of the custody legal structure.HashKey has some explanations about this in its prospectus, but it still needs to be analyzed in conjunction with Hong Kong’s current laws.
Legal Basis.Securities and Futures OrdinanceIt stipulates the segregation obligations of licensed corporations for client assets, and clarifies in Article 120 that client assets do not belong to the company’s bankruptcy estate.The Companies (Winding Up and Miscellaneous Provisions) Ordinance provides that,In a liquidation proceeding, client assets should be identified and returned to the client rather than included in the liquidation asset pool.
HashKey arrangement.Page 34 of the prospectus states that “customer assets are fully segregated from own funds… All customer assets are kept by licensed custody affiliates and stored in segregated wallets independent of self-operated accounts… Customer assets are completely segregated at all times.” At the same time, page 68 clearly states in the terms of the customer agreement that “customer assets are treated as customer assets and do not form part of our assets in the event of bankruptcy and must be returned to customers in accordance with applicable laws and regulations.”
This shows that HashKey is trying to legally establish the “non-bankruptcy property” status of customer assets through contractual agreements and structural design.
Comparison with traditional securities brokerage customer asset protection mechanisms.In the field of traditional securities, Hong Kong has an Investor Compensation Fund, which is used to provide limited compensation to retail investors (with a maximum limit of HK$500,000 per person) when a broker goes bankrupt.In addition, securities client assets are usually deposited in the Central Settlement System (CCASS) or designated custodian banks, and the legal segregation is relatively clear.
In contrast, the virtual asset field currently lacks a similar compensation fund mechanism and is not included in Hong Kong’s deposit protection scheme.Although HashKey covers some risks through insurance, there is still uncertainty as to whether the insurance coverage will cover the inability to recover assets due to the platform’s bankruptcy.
In summary, there are some potential issues that require our attention.Legal characterization is not completely unified,Whether virtual assets are legally defined as “property” or “securities” affects how they are treated in bankruptcy proceedings;Cross-border custody risks,HashKey operates in multiple jurisdictions, and if its main custody entity is located outside Hong Kong, the bankruptcy proceedings may involve cross-border legal conflicts;Limitations of Insurance Coverage.Insurance mainly covers security incidents such as theft and hacking, rather than platform bankruptcy itself;Regulation is still evolving;The relevant rules for virtual asset custody in Hong Kong are not yet as complete as those for securities custody. In particular, the specific procedures for asset disposal in the event of platform bankruptcy are not yet clear.
4. Innovation Challenges
HashKey has built a relatively complete customer asset protection system through licensed custody, compliant allocation of hot and cold wallets, legal asset isolation and multiple insurance arrangements.The custody structure shown in its prospectus reflects its high degree of compliance with the regulatory requirements of the Hong Kong Securities Regulatory Commission and also reflects its development strategy of becoming a “compliance first” platform.
Although its custody model still has some legal and operational risks worthy of attention, overall HashKey’s custody structure represents the cutting-edge practice of Asia’s compliant virtual asset platform in customer asset protection. It strives to maximize customer asset security within the current legal framework through multiple technologies, contracts, and insurance means.
The legal environment for virtual asset custody is still developing. While investors recognize its compliance efforts, they should also be aware that the relevant legal protection mechanisms need to be further improved.In the future, with the further refinement of Hong Kong’s virtual asset legislation, especially the clarification of the rules for the disposal of customer assets in the event of platform bankruptcy, the degree of legalization of virtual asset custody is expected to be further improved, laying a solid foundation for the long-term and healthy development of the industry.
