10th September 2026
By Joe Pan
Hong Kong already mandates client-asset compensation, and digital asset insurance serves as one solution available to satisfy this requirement by leveraging insurers’ balance sheets—or is this just a costly window dressing?. “Insurance is essentially a transfer of risk,” said Onno Sterk, head of digital assets at Oneglobal, a Lloyd’s insurance broker. For Hong Kong’s licensed crypto platforms, the more revealing question is what risks an insurer is willing to take — and what it demands before putting its balance sheet behind a virtual-asset business.
That question is moving closer to the center of Hong Kong’s digital-asset agenda. The Securities and Futures Commission’s 2025 A-S-P-I-Re regulatory roadmap says insurance and compensation arrangements are an “important safety net” for virtual-asset service providers, or VASPs. More significantly, the watchdog says it will engage stakeholders on frameworks that are more diverse and risk-based, while letting operators tailor arrangements to their business model and investor profile.
That is not a new blanket insurance mandate in the making, at least not yet. Hong Kong already requires licensed virtual-asset trading platform operators to maintain an SFC-approved compensation arrangement for potential client-asset losses. It is a hybrid rule: the arrangement must cover 50% of client virtual assets in cold storage and 100% in hot or other storage, but it may combine third-party insurance with trust-set-aside funds and bank guarantees [1].
The direction of travel, however, matters. The SFC’s roadmap explicitly identifies insurance and compensation as an area for enhancement, and pairs that work with a planned shift from rigid custody prescriptions toward outcome-based safeguards. Under the proposal, real-time transaction monitoring, independent audits and “compensation-backed hot wallets” could complement less prescriptive storage arrangements.
For insurance brokers, underwriters and specialist security firms, that creates a potentially consequential opening. It also places Hong Kong in a growing global conversation: whether crypto insurance should remain a voluntary commercial tool, become part of a prudential toolkit, or serve as the practical bridge between technology controls and retail investor protection.
A rule already exists — but not insurance-only
Hong Kong’s current arrangement is often described loosely as an insurance requirement. It is more precise to call it a mandated compensation requirement in which insurance is one permitted route, not the only route.
The rules grew out of the VATP regime that began in June 2023. The SFC’s requirements cover custody, client-asset protection, risk management, cybersecurity, AML and other operational controls. Licensed platforms generally must keep at least 98% of client virtual assets in cold storage; their approved compensation arrangement must match the 50% cold-storage and 100% hot- or other-storage coverage thresholds.
That architecture changes the commercial conversation. An operator may choose to use insurance, but it cannot simply purchase a policy and assume the job is done. The arrangement is subject to regulatory approval, daily monitoring and remediation if assets under custody exceed the amount covered. The SFC’s 2023 tokenised-securities circular also confirmed that VATPs must maintain the approved arrangement for potential losses, while allowing case-by-case relief where a platform can demonstrate effective mitigants against loss.
Crypto Insurance Depends on Strong Risk Controls
Sterk, whose earlier comments were provided to Blockwind News, describes the underwriting logic plainly: “Insurers will only underwrite a particular risk if they are comfortable with the risk controls, the control framework and the processes that are in place at an organization.”
That makes the policy a trailing indicator of operational discipline as much as a financial product. It is not a magic helmet; it is more like a helmet store that asks to inspect your brakes before it sells you one.
Sterk said insurance remains attractive compared with locking up capital or securing committed bank facilities. “Insurance, from a balance-sheet efficiency and a capital-efficiency perspective, is probably the best solution out there,” he said. He also said aggregate capacity for a single insured’s custody program, especially cold-wallet coverage, has grown to roughly US$1.3 billion, from a market that offered the first buyer of digital asset insurance, only about US$5 million of custody around ten years ago.
Those figures are Sterk’s market assessment and should not be confused with a Hong Kong coverage threshold. The city’s rule is measured against client assets in custody, while the form and composition of an approved arrangement remain central to the SFC’s evaluation.
Europe offers a useful comparison
The European Union’s Markets in Crypto-Assets Regulation, or MiCA, does not impose an insurance-only obligation on every crypto-asset service provider, known in Europe as a CASP. But it does place insurance directly inside the prudential-safeguards menu.
Article 67 requires CASPs to maintain prudential safeguards equal to at least the higher of their applicable permanent minimum capital requirement or one-quarter of the previous year’s fixed overheads. Those safeguards may be made up of own funds, an insurance policy covering the EU territories where services are offered, a comparable guarantee, or a combination. Where a provider relies on the insurance option, the policy must be publicly disclosed and cover prescribed exposures, including business disruption and system failures, and, where relevant, gross negligence in safeguarding clients’ crypto-assets and funds [3].
MiCA separately makes custody-and-administration providers liable to clients for loss of crypto-assets or access means caused by an incident attributable to the provider, subject to a cap at the assets’ market value when the loss occurred.
That is an important distinction for Hong Kong policymakers and operators: MiCA offers an insurance-or-capital mechanism, while Hong Kong has chosen a compensation arrangement tied directly to custody exposure. Both models try to avoid an awkward result in which a licensed provider has a polished compliance manual but no credible source of recovery after a failure.
There is, as of September 2026, no enacted “MiCA 2.0” insurance mandate. The European Commission has opened a review of MiCA, and the formal report due by June 30, 2027 may be accompanied by legislative proposals. The review is examining the framework’s application and operational-resilience implications, but it is not itself a new insurance rule [4].
Security is the price of admission
At a Hong Kong panel moderated by WiW3HK Co-Founder Melizza Anievas, Esme Pau, head of capital markets and policy at CertiK, said the critical vulnerabilities increasingly come down to “people” and “keys.” She warned that a code audit has boundaries: “A hack or vulnerability might fall outside that scope.”
For insurers, that caveat is not academic. Sterk said insurance works “provided that the risk-control framework on the basis of which policies are written is in place.” Pau’s broader point was that “the biggest vulnerability is actually between on-chain and off-chain” — the seam where code meets human permissions, custody processes, banking rails and third-party operations.
Emil Chan added that insurance could be important for wider adoption, arguing: “Without insurance, there is no chance for general practitioners to buy in.” His longer-term vision is more radical: tokenized money, assets and eventually insurance trust moving onto Web3, with smart contracts taking a larger role.
Hong Kong Moves Toward a More Flexible Crypto Insurance Market
For now, Hong Kong’s immediate task is less sci-fi and more plumbing. The SFC says it will consult and engage on a framework that gives platforms more flexibility without compromising asset protection. That may pull more market capacity toward Hong Kong from specialist brokers like Oneglobal, Lloyd’s of London underwriters, security auditors and custody providers [2].
The prize is not simply more policies. It is a market where a VASP can demonstrate that its cyber controls, key management, governance and compensation plan are good enough for both a regulator and a risk carrier to believe the same thing: when the worst happens, customers are not left holding the cold wallet.
Footnote and Reference
- [1] Hong Kong: The SFC’s A-S-P-I-Re roadmap says it will engage stakeholders to enhance insurance and compensation frameworks; it does not announce an insurance-only mandate. The current VATP rule requires an SFC-approved compensation arrangement, potentially including third-party insurance, trust funds and bank guarantees.
- [2] HKMA stablecoins: The HKMA’s stablecoin regime took effect on Aug. 1, 2025 after a January 2022 discussion paper and a December 2023 public consultation process. The materials retrieved for this draft establish licensing, reserve, custody and supervisory frameworks; they do not establish a general insurance requirement for licensed stablecoin issuers.
- [3] European Union: MiCA Article 67 permits an insurance policy or comparable guarantee to comprise all or part of a CASP’s prudential safeguards, subject to stated conditions and risk coverage. It is not a universal requirement that every CASP hold standalone insurance.
- [4] MiCA review: “MiCA 2.0” is a market shorthand for the ongoing European Commission review. No new insurance mandate had been enacted as of the research date. The Commission review may inform a report, and potentially legislative proposal, by June 30, 2027.
About the Arthur
Joe Pan is an editor and producer at Blockwind News. An early adopter of blockchain technology, he has covered major crypto conferences globally since 2019 and moderated Web3 events across Asia. Joe is part of the founding team of Blockwind News and teaches Asia’s first Master of Journalism course on “Covering Cryptocurrency and Blockchain” at Hong Kong Baptist University.
