#
Retail suitability, custody-segregation, compensation-arrangement and marketing rules have applied since the 2023 VATP launch. An August 2025 SFC custody circular added further senior-management, cold-wallet, third-party-oversight and monitoring expectations. Staking-specific risk-disclosure requirements apply since April 2025.
These baseline protections were reinforced in August 2025 by a dedicated SFC custody circular that took effect immediately and raised expectations across several dimensions: senior-management responsibility for custody outcomes, cold-wallet infrastructure standards, oversight of third-party wallet providers, and real-time threat monitoring. This circular does not replace the original 2023 custody-segregation and compensation requirements but adds a further, more granular layer of operational expectation on top of them, consistent with a broader tightening trajectory in this module. Staking-specific consumer protection was addressed separately in April 2025: licensed VATPs and authorized virtual-asset funds offering staking must clearly disclose the associated risks to clients and implement safeguards protecting staked client assets, mirroring the risk-disclosure logic applied elsewhere in the consumer-protection framework.
Outlook
The consumer-protection module's trajectory has been consistently tightening rather than static, with each expansion of permitted retail-facing activity (staking, and by extension the professional-investor derivatives framework) accompanied by a corresponding disclosure or safeguard requirement. The open question going forward is how — or whether — equivalent consumer protections will be extended to the second-wave licensing perimeter (dealer, custodian, advisory, management services) once those bills are introduced; the current consumer-protection architecture is built specifically around the VATP licensing structure, and its applicability to intermediary categories that fall outside that structure is not yet defined. Firms and their clients operating in the gap between the current VATP perimeter and the pending second-wave regimes should treat the existing suitability, custody, compensation and marketing protections as not yet automatically extending to those adjacent categories of activity.
no periodic updates on record for this sub-brief
Sources and findings (5)
- T3 · CoinDeskSFC VATP retail suitability rules — Licensed VATPs may only offer retail investors 'eligible large-cap virtual assets' and must assess client risk profile/understanding before permitting access.retrieved M4bindingin force
- T3 · CoinDeskSFC VATP custody/compensation rules — Segregation of client and proprietary virtual assets via escrow/set-aside arrangements, plus an SFC-approved compensation arrangement fully covering client virtual assets held.retrieved M4bindingin force
- T4 · The BlockSFC custody standards circular (Aug 2025) — New custody expectations for VATPs on senior-management responsibility, cold-wallet infrastructure, third-party wallet oversight and real-time threat monitoring, effective immediately.retrieved M4bindingin force
- T3 · CoinDeskSFC VATP marketing rules — Crypto 'gifts' designed to incentivise retail customer investment, understood to capture airdrop-style promotions.retrieved M3bindingin force
- T3 · CoinDeskSFC staking risk-disclosure rules — Licensed VATPs and authorized VA funds offering staking to clearly disclose associated risks and implement safeguards protecting staked client assets.retrieved M3bindingin force