The Hong Kong Securities and Futures Commission (SFC) has issued new, immediately effective guidance on cryptocurrency custody standards, introducing sweeping security requirements and a ban on smart contracts in cold wallet implementations.

In a circular released Friday, the regulator outlined prescriptive controls for licensed custodians of virtual assets. The measures include requiring a certified hardware security module, allowing withdrawals only to whitelisted addresses, and maintaining a 24/7 security operations center to monitor systems, networks, wallets and infrastructure.

The environment where private keys are used to sign transactions should also be air-gapped and physically secured, with keys being generated and kept offline….