Before a licensed virtual asset trading platform in Hong Kong matches its first trade, the SFC requires it to incorporate a second company. The Guidelines for Virtual Asset Trading Platform Operators say it plainly: a platform "should only hold client assets on trust for its clients through its Associated Entity," and that entity "should not conduct any business other than that of receiving or holding client assets on behalf of the Platform Operator." Wholly owned, incorporated in Hong Kong, licensed as a trust or company service provider, doing nothing else.
Thirteen platforms hold the licence as of late September 2026, none added since May. Every one of them runs that two-company structure. The licence doesn't just regulate the trading venue. It writes the shape of the finance function into law.
One licence, two companies, real money
You can watch the rule play out in public filings. OSL Group, whose OSL Digital Securities was Hong Kong's first licensed platform, names its custody twin in its own results: client digital assets are "safekept in segregated client wallets through a trust arrangement with OSL Custody Services Limited," a wholly owned subsidiary and the associated entity of the licensed platform. The subsidiaries note in the group's annual report lists thirteen principal companies: investment holdcos in the BVI, a treasury and technical services company, the licensed platform, the custody entity, and arms in Singapore, Japan, and the mainland.
The money inside that structure is not hypothetical. At the end of 2024, client digital assets held through the trust arrangement stood at approximately HK$5.0 billion, up from HK$874.7 million a year earlier. A 5.7x jump in assets that belong to customers, sitting inside a company whose entire legal purpose is holding them, reconciled against the platform's records.
HashKey runs the identical pair: Hash Blockchain Limited operates the exchange, and client assets sit with HashKey Custody Services Limited, a TCSP licensee. The same anatomy repeats across the register.
Five billion Hong Kong dollarsof client assets.Two companies hold it.
OSL keeps client digital assets on trust — off its own balance sheet, and entirely its responsibility. Hong Kong’s rules put that obligation inside two entities: the SFC-licensed platform, and the custody company it is required to own.
The custody company sits under the licensed platform, not beside it — that direct ownership is what the associated-entity rule requires.
The assets are not on OSL’s balance sheet. The obligation is.
Sources — OSL Group (HKEX: 863) FY2024 results announcement, 24 Mar 2025, Note 10: client digital assets of HK$5,004,094,000 (FY2024) and HK$874,731,000 (FY2023), safekept in segregated client wallets through a trust arrangement with OSL Custody Services Limited and “not recognised as the Group’s digital assets”. Ownership chain per GLEIF records for OSL Custody Services Limited (direct parent: OSL Digital Securities Limited). OSL’s own results release describes assets under custody as a 5.6-fold rise, on a slightly broader measure than the audited note. ETF custody share is OSL’s own figure.
The obligations that run on a clock
The Guidelines then load that structure with deadlines. A monthly return covering liquid capital goes to the SFC no later than three weeks after month end. Clients receive statements within seven business days of month end. An annual return is due within four months of year end. Miss the cadence and you're explaining yourself to a regulator that pre-approves the auditors of both your companies.
The asset-side rules are just as ledger-shaped. Platforms and their associated entities "should store 98% of client virtual assets in cold storage," with the remainder in hot and other storage. A compensation arrangement approved by the SFC has to cover potential loss of 50 percent of client assets in cold storage and 100 percent of everything warmer, and the Guidelines require monitoring its adequacy daily. Daily monitoring against a moving asset base means a daily valuation of client holdings, wallet by wallet, storage tier by storage tier.
Capital floors sit underneath: HK$5 million paid-up share capital, liquid capital of at least HK$3 million, and twelve months of operating expenses held in liquid assets that are, pointedly, "not virtual assets." The platform's own treasury book and its clients' assets live under different rules, in different companies, and both have to be provable at any moment.
On the balance sheet or off it
Here's the question that surprises finance teams arriving from other industries: do trust-held client assets appear on your balance sheet at all? HKFRS gives no bright-line answer. It's a control judgement, and Hong Kong's filed accounts show both outcomes. OSL's own group accounts recognise client assets held by some subsidiaries with a matching liability to customers, while digital assets held in segregated wallets under other arrangements stay off the balance sheet, entity by entity, depending on the trust terms.
Either answer is defensible. The ledger has to be able to support whichever one you give. On-balance-sheet treatment needs the gross positions and the customer liability carried cleanly per entity. Off-balance-sheet treatment needs memorandum accounts and a daily reconciliation proving the records match the wallets. Settle the judgement with your auditor early, then build the account structure to match it.
The ordinary rules still stack on top
None of this displaces Hong Kong's baseline. Every active Hong Kong company has its financial statements audited annually, however small, and a group prepares consolidated accounts under s.379 of the Companies Ordinance. A holdco that's itself wholly owned by an offshore parent is excused, but the duty just moves up the chain, where the parent's auditors want the same numbers. A licensed group is therefore running three overlapping reporting regimes at once: the SFC's monthly clock, the statutory audit per company, and the group consolidation.
The industry has already produced its cautionary tale about what happens when the books don't match the ambition. When Celsius collapsed, the court-appointed examiner found the multi-billion-dollar lender had tracked its finances across 15 separate QuickBooks files, with no automatic consolidation and significant discrepancies between the files and the statements built from them. The unanswered question in the forums afterwards was what real businesses use instead. In Hong Kong, the licence conditions effectively answer it for you.
Where to start
The working architecture has settled: a crypto sub-ledger such as Cryptio or Bitwave ingests the chains, custodians, and venues, then posts summarized journals into a general ledger that holds the whole group. The platform, the associated entity, the treasury company, and the offshore holdcos close together, with client asset books structurally walled off from house books and closed periods locked. That's the ledger the monthly return, the daily compensation check, and the audits of both entities all draw from.
Our digital assets industry page covers how we configure NetSuite for licensed platforms and the groups behind them, and our implementation page walks through what a project involves. The SFC has already decided what your ledger has to prove. The only open question is whether proving it takes an afternoon or a season.
