Hong Kong’s SFC and HKMA advance a virtual asset ecosystem with new staking services guidance for virtual asset trading platforms, banks and authorised virtual asset funds

Authors from Herbert Smith Freehills Kramer explore the latest regulatory guidance from the SFC and HKMA on virtual asset staking services for Hong Kong to foster a secure, innovative and responsive virtual asset ecosystem.

Hong Kong has demonstrated a steadfast commitment to supporting the development of virtual assets (VAs) and, through continuous efforts in recent years, has positioned itself as a leading hub in the digital economy. Both the Securities and Futures Commission (SFC) and the Hong Kong Monetary Authority (HKMA) continue to lead the way, introducing new regulatory guidance to secure and grow virtual asset markets.

Most recently:

• the SFC and HKMA have respectively issued circulars to permit SFC-licensed VA trading platforms (VATPs) and authorised institutions (AIs) to provide staking services to clients, and to set out the regulatory requirements for providing such services
• the Appendix to the SFC VATP circular also contains specific conditions which the SFC will impose on a VATP’s licence before it may provide staking services, and
• the SFC has revised its circular on SFC-authorised funds with exposure to VAs (SFC-authorised VA Funds) to facilitate their engagement in staking, and has also updated the relevant FAQs.

The new guidance was made in response to investors’ demand for staking services, as well as the potential for staking activities to contribute to the security of the blockchain network. These initiatives are part of the SFC’s ‘ASPIRe’ roadmap to develop Hong Kong’s virtual asset ecosystem, which aims to enhance the security, innovation and growth of Hong Kong’s VA market. Specifically, staking and VA-related activities were identified as an initiative under Pillar P (Products) of the roadmap.

What are staking services?

Both the SFC and the HKMA refer to staking services as any arrangements that involve the process of committing or locking client VAs for a validator to participate in a blockchain protocol’s validation process, based on a proof-of-stake consensus mechanism, with returns generated and distributed for that participation (Staking Services). Staking allows investors to lock up their VAs to support blockchain networks and therefore earn rewards in return.

SFC’s regulatory guidance to VATPs on provision of staking services

On 7 April 2025, the SFC issued a circular setting out its regulatory approach and expected standards in respect of VATPs that wish to provide Staking Services to their clients. VATPs seeking to provide Staking Services should note the following regulatory requirements.

First, VATPs must maintain strong internal controls.

• Possession or control. VATPs should maintain possession or control of all mediums through which the client VAs may be withdrawn from the Staking Services. Custody of client VAs by third party service providers is not permitted.
• Safeguarding assets. VATPs should maintain effective policies to prevent or detect errors and other improper activities associated with its Staking Services, and ensure the ‘staked’ client VAs are adequately safeguarded.
• Operational risk and conflicts. VATPs should implement internal controls to manage operational risks and address conflicts of interest that may arise. Operational rules governing the provision of Staking Services should be in place.
• Provision of information to the SFC. VATPs should provide the SFC with any information in relation to its Staking Services as requested from time to time.

Second, VATPs must make disclosures regarding the details of the Staking Services and risks involved.

• General information. VATPs should disclose on their website and mobile application (if applicable) general information about their Staking Services, including specific VAs involved, any third parties involved in providing such services, fees and charges, minimum lock-up periods, the unstaking process and its length, arrangements during outages, business resumption arrangements and custodial arrangements.
• Risk disclosure. VATPs should disclose the risks that clients may be exposed to in using their Staking Services, including the types and nature of additional risks that the ‘staked’ client VAs may be subject to, and the manner in which losses relating to such risks would be dealt with. Examples of these additional risks are slashing risk, lock-up risk, blockchain technical error/bug risk, hacking risk and inactivity risk relating to the validators, as well as the legal uncertainty relating to staking that may affect the nature and enforceability of clients’ interests in the ‘staked’ client VAs.

Third, VATPs must perform due diligence when selecting blockchain protocol and third party service providers.

• Blockchain protocols. VATPs should act with due skill, care and diligence when including a blockchain protocol for providing Staking Services. They must perform all reasonable due diligence and ensure that their internal controls and systems, technology and infrastructure can support the provision of Staking Services in that blockchain protocol, and manage any risks arising from it.
• Third party service providers. If the provision of Staking Services involves outsourcing to a third party service provider, VATPs should perform proper due diligence and conduct ongoing monitoring on the third party. For example, VATPs should look into the third party service provider’s experience and track record in participating in the validation process of a particular blockchain protocol, its technology infrastructure and risk mitigation measures, and its security measures including security controls.

Fourth, VATPs should also obtain prior written approval from the SFC to provide Staking Services. The SFC will impose specific conditions on the VATP’s licence before allowing the provision of these services.

HKMA’s standards for provision of staking of VAs as a service by AIs

Separately, the HKMA has published a circular to impose requirements on AIs and subsidiaries of locally incorporated AIs that provide Staking Services from custodial services to clients. Locally incorporated AIs should ensure that their subsidiaries’ business conduct, practices and controls comply with the circular’s requirements.

We set out below the key requirements under the HKMA circular, which apply to both AIs and subsidiaries of locally incorporated AIs (both fall within the term ‘AI’ for the purposes of this circular). These requirements follow similar principles as the SFC’s requirements to VATPs summarised above.

Internal controls

AIs should:

• maintain possession or control of all mediums through which client VAs may no longer be ‘staked’
• maintain effective policies to prevent or detect errors and other improper activities associated with their Staking Services
• ensure the ‘staked’ client VAs are adequately safeguarded
• implement internal controls to manage operational risks and address conflicts of interest that may arise, and
• put in place operational rules governing the provision of Staking Services.

Disclosure of information

AIs should disclose general information about their Staking Services. This includes the specific VAs for which the AIs provide Staking Services, any third parties involved in providing such services, fees and charges, activation periods, minimum lock-up periods, reward payout arrangements, the unstaking process and its length, uptime performance, arrangements during outages, business resumption arrangements and custodial arrangements. AIs should disclose the risks that clients may be exposed to in using their Staking Services, including the types and nature of additional risks that the ‘staked’ client VAs may be subject to, and the manner in which losses relating to such risks would be dealt with. Examples of these additional risks include (among others) slashing risk and lock-up risk.

Blockchain protocol selection and third party service providers

AIs should act with due skill, care and diligence when including a blockchain protocol for providing Staking Services. They must perform all reasonable due diligence and ensure their internal controls and systems, technology and infrastructure can support the provision of Staking Services in that blockchain protocol, and manage any risks arising from it. Where the provision of Staking Services involves outsourcing to a third party service provider, the AI should perform proper due diligence and conduct ongoing monitoring on the third party service provider. For example, the AI should look into the third party service provider’s experience and track record in participating in the validation process of a particular blockchain protocol, its technology infrastructure and risk mitigation measures, and its security measures including security controls.

Before engaging in Staking Services, AIs are reminded to implement adequate policies, procedures, systems and controls to ensure compliance with the requirements set out above and other applicable requirements, and discuss these with the HKMA in advance.

SFC’s updated guidance for SFCauthorised VA Funds to facilitate engagement in staking

On 7 April 2025, the SFC updated its circular to include new requirements for SFC-authorised VA Funds engaging in VA-related activities, including staking.

The revised circular supersedes the previous version of the circular issued on 22 December 2023.

The SFC may allow SFC-authorised VA Funds to engage in staking and other VA-related activities conducted through SFC-licensed VATPs or, where applicable, AIs (or subsidiaries of locally incorporated AIs), subject to adhering to the general guiding principles set out below.

Objective and strategy

The management company should ensure that the VA-related activities are consistent with the fund’s investment objective and strategy.

Internal controls

The management company should implement robust internal controls to monitor and manage material risks and conflicts of interest arising from the VA-related activities. It should also establish appropriate custody arrangements in the best interests of investors for investor protection.

Due diligence

The management company should perform proper due diligence and conduct ongoing monitoring of the counterparties and service providers engaged for the VA-related activities.

Disclosure

The fund’s offering documents, including the key facts statements (KFS), should disclose the amount of VAs that may be used for VA-related activities, and the key features and risks associated with these activities.

Notification obligations

If engagement in VA-related activities will result in a material change to the fund’s existing investment objective and strategy, or a material change or increase in the fund’s overall risk profile, prior notice should be provided to investors with a reasonable notice period. The management company should also assess whether shareholders’ approval and/or amendments to constitutive documents are required.

Interim and annual reports

In addition to complying with the relevant disclosure requirements in Appendix E of the Code on Unit Trusts and Mutual Funds (UT Code), the interim and annual reports should disclose the total amount of VA holdings committed to each type of VA-related activities as a proportion of the fund’s net asset value, the amount of revenue, and the direct and indirect expenses incurred through each such activity.

SFC-authorised VA Funds intending to engage in staking and other VArelated activities would require prior consultation with and approval of the SFC.

Additionally, the SFC has also updated its FAQs on the UT Code to include the newly added Question 20F, which outlines further requirements for management companies of SFC-authorised VA Funds engaged in staking.

Cap on staking activity

The fund should only engage in staking through VATPs and AIs (or subsidiaries of locally incorporated AIs), subject to a cap reasonably determined by the management company taking into account the liquidity needs and investment strategy of the fund.

Custody

The management company should ensure that the fund’s staked VA holdings remain under custody by the VATP or AI (or subsidiary of a locally incorporated AI).

Due diligence

The management company should perform proper due diligence and conduct ongoing monitoring of VATPs or AIs (or subsidiaries of locally incorporated AIs) and the Staking Services that they provide either directly or by outsourcing to a third party service provider.

Disclosure obligations

The offering documents, including the KFS, of the fund should, as a minimum, disclose the following:

• general information about the staking arrangements (including the name of the service provider and whether it is an affiliate of the VATP or AI (or subsidiary of locally incorporated AI))
• the amount of VAs that can be staked
• a general statement that there is no change in the ownership of VA held by the fund during the staking process
• the manner in which losses relating to staking would be dealt with, and
• key risks associated with staking include slashing risk, lock-up risk, blockchain technical error/bug risk, hacking risk and inactivity risk relating to the validators, as well as the legal uncertainty relating to staking that may affect the nature and enforceability of the fund’s interest in the ‘staked’ VAs.

Hannah Cassidy, Partner, Head of Financial Services Regulatory, Asia; Simone Hui, Of Counsel; Valerie Tao, Knowledge Lawyer; and Christie Tsang, Trainee Solicitor

Herbert Smith Freehills Kramer, Hong Kong

© Copyright May 2025 Herbert Smith Freehills Kramer

This article is reprinted from a Herbert Smith Freehills Kramer note published on 7 May 2025.