To Keep Safe: Why Regulated Independent Virtual Asset Custody is so important | EX.IO

“Where the coins are” determines two things: whom you would pursue if something goes wrong, and whether institutions can write the asset into their internal custody policies. Investors in Hong Kong often call three entirely different arrangements “custody” — an exchange account, safekeeping of private keys by platform-related entities, and custody services that are independent of the trading venue.

Three arrangements, three kinds of counterparty risk

Exchange account positions. You open an account on a VATP to buy assets, and the assets are held by the platform or its related entities under the client asset rules, for settlement and withdrawals. The advantage is convenience of trading; the trade-off is that custody and trading are bound up in the same relationship. A licensed platform is required to keep the vast majority of client virtual assets in cold wallets and to segregate client assets, but you are still exposed to the platform’s operational and system risks, and to the risk of a run on withdrawals.

Platform-related custody. A number of VATPs have a related entity provide safekeeping for assets that are “offered and traded on the platform itself”. This is still custody within the exchange ecosystem — it is not “coins I bought elsewhere can also be placed with this custodian”.

Independent custody. This refers to keeping, within the scope permitted, virtual assets or tokenised securities for clients that are not necessarily bought or sold on the platform itself. For institutions, this is closer to the logic of a traditional private bank or custodian bank: trading can take place across multiple venues, while safekeeping is centralised with a single regulated institution, which issues statements of holdings.

Virtual asset custody and securities custody

Securities custody covers shares, bonds and fund units, under a mature framework: segregation of client assets, bankruptcy remoteness, trust or custody contracts, and clearly defined roles for clearing houses and share registrars.

The core risk of virtual asset custody is control over the “instrument by which assets can be transferred away” — typically the private keys, key shards or equivalent control rights. Whoever holds the right to transfer assets out functionally controls the assets. This is also why Hong Kong’s proposed virtual asset custody licence puts the regulatory focus on “safekeeping transferable instruments on behalf of clients”.

Therefore, when assessing an institution, do not only ask whether it “has a cold wallet”; instead, ask:

– whether client assets are legally segregated from the institution’s own assets

– which entity holds the private keys or key shards

– how many layers of authorisation withdrawals require, and whether there is independent approval

– whether it can issue position and valuation reports acceptable to the institution

– whether the legal ownership of tokenised securities is recorded on-chain, in a register, or in dual records

Hong Kong’s institutional milestones

Two tracks are running in parallel:

1. The client asset rules under the existing VATP framework (98% cold storage, insurance or equivalent arrangements, safekeeping by related entities, etc.).

2. The forthcoming statutory regime for virtual asset custody and dealers. The Government has indicated that the relevant legislative amendments are expected to be introduced in 2026 and, unlike the 2023 trading platform regime, will not provide the kind of “deemed to be licensed, operate while applying” arrangement.

For institutions, the implication is that “who may hold your private keys for you” will in future become a licence in its own right, rather than a bonus feature attached to the exchange licence. Teams that now need to record counterparties in their internal memoranda should give priority to licensed institutions that have already obtained clear authorisation under the existing framework and have disclosed the scope of their custody services.

Why independent custody matters particularly for RWA

Tokenised funds, tokenised bonds or equity-linked products often have, at the same time:

– on-chain records

– traditional registers or issuer records

– underlying assets held in custody by banks or trustees

If the trading takes place on Platform A, the underlying assets sit with Bank B and the legal interests rest with Issuer C, investors need a custodian that can reconcile across these records, rather than one that can only “view a balance” on a single exchange. This is the layer that independent custody is about.

EX.IO’s publicly disclosed capability boundaries

In June 2026, EX.IO announced an update to its licence conditions, covering two capabilities directly relevant to this page:

– distribution of traditional investment products (including tokenised and non-tokenised securities)

– independent custody services for virtual assets and tokenised securities held by clients outside the platform

This does not mean that every asset type has been fully activated, nor that it replaces a dedicated custody licence in the future. Its public implication is that, under the existing VATP / Type 1 (dealing in securities) framework, the platform has been authorised to extend “safekeeping” beyond “safekeeping only the coins traded on the venue itself”. The specific products activated, contractual terms and fees are as set out in the client documents.

A minimal due diligence checklist for institutions

– whether the licensed corporation’s name and CE number are consistent with those in the contract

– whether the custody scope covers “assets traded on the venue” or “assets held off-platform”

– the cold/hot wallet ratio, multi-party authorisation and withdrawal times

– whether the legal opinions on tokenised securities cover interests recognised under Hong Kong law

– how client assets would be recovered in an insolvency scenario (legal opinions, not a marketing deck)

– whether it can support auditor confirmations

FAQ

Q: Does holding assets on a licensed exchange mean I have independent custody?

A: No. An exchange account holding is a position oriented towards trading and settlement; independent custody is a safekeeping service that can be separated from the trading venue.

Q: Is a cold wallet absolutely infallible?

A: No. Cold storage reduces the online attack surface; it does not eliminate the risks of operational errors, insiders, supply chain issues or unclear legal title.

Q: Can I transfer coins bought on other platforms here for custody?

A: It depends on the scope authorised to the licensed institution at the time, its asset whitelist and the account opening documents. Do not assume that “licensed = accepting any token”.

Q: When will Hong Kong have an independent virtual asset custody licence?

A: The Government has indicated that the relevant legislative amendments are expected to be introduced in 2026. The commencement date is as set out in the Gazette and the legislative process.

Disclaimer

This article is a general educational note and does not constitute custody, legal or investment advice. The scope of services is as set out in the licence conditions and the client contract, which prevail.