Why Does Hong Kong Require 98% Cold Storage for Crypto Platforms?
Why does Hong Kong require 98% cold storage for crypto platforms? The core reason is to shrink the share of client assets exposed to online attacks to a minimum. Most major exchange losses in history have come from hot wallets, so the Hong Kong SFC requires licensed virtual asset trading platforms to keep at least 98% of client virtual assets in cold storage. Even if a hot wallet is compromised, losses stay within a very small range.
What Exactly Is the 98% Cold Storage Requirement?
The requirement comes from the SFC’s regulatory guidelines for virtual asset trading platforms. Client assets must be held on trust by a wholly owned subsidiary of the platform, with at least 98% in a cold wallet and no more than 2% in a hot wallet for day-to-day withdrawals. Platforms must also arrange insurance or compensation for client assets, with stronger coverage expected for the online portion. The ratio is calculated on client assets, and platforms must monitor and maintain it continuously, not just meet it once at the time of licensing. The SFC’s wider expectations on key management are best read alongside its robust custody standards.
How Does This Rule Affect Platform Operations?
The most direct impact is on withdrawals. The hot wallet balance is capped, so when users withdraw heavily or in large amounts, the platform must first move funds from cold storage, and cold wallet signing involves offline steps and multi-person approval, which can delay withdrawals. Deposits are the second issue, since incoming funds raise the online ratio and must be swept into cold storage promptly. The third is operational load: transfers between hot and cold wallets become more frequent, each one is a high-risk operation that must follow a safe process for moving funds between hot and cold wallets, and daily reconciliation must confirm that the ratio still holds.
How Can Platforms Keep Withdrawals Smooth Within the 2% Limit?
The key is to treat the hot wallet as a carefully managed reservoir. Estimate demand for each chain and asset from historical withdrawal data and market volatility, set hot wallet balances and top-up rules within the 2% cap, and schedule deposit sweeps at sensible times. For large withdrawals beyond what the hot wallet can handle, tell users the processing time in advance and pay out directly from cold storage. The cold wallet signing process itself should be rehearsed so it can be completed within an acceptable time when needed. If a platform uses newer key technologies such as MPC, it should confirm with the SFC which assets count as cold storage.
Conclusion
Hong Kong requires licensed trading platforms to keep at least 98% of client virtual assets in cold storage so that losses from a compromised hot wallet stay minimal. This makes withdrawals, deposit sweeps and hot-cold transfers more complex, and platforms need to size their hot wallets carefully while keeping cold wallet processes both secure and controllable. Safeheron’s MPC Wallet-as-a-Service provides businesses with MPC key management and a policy engine.
Designing a wallet architecture that meets the 98% cold storage requirement? Contact Safeheron’s Sales Team to Book a 1:1 Demo
Looking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.
Request a DemoLooking for a secure way to manage digital assets?
Talk to our experts and find the right solution for your business.