Crypto custody law in Dubai, Singapore and Hong Kong: who licenses custodians and what a licence covers

Key takeaways

Three markets, three legal routes: an activity licence in Dubai, a payment-services licence in Singapore and, in Hong Kong, a regime that was still a proposal on 11 October 2026.

This guide is for compliance and legal readers. It is for information only and is not legal or investment advice. The hub lists more regulation and custody guides in Insights.

At a glance: three regimes compared

Dubai licenses the custody activity itself, Singapore licenses a payment service that includes safeguarding tokens, and Hong Kong so far regulates custody only inside trading platforms and banks. Each cell below was checked against the regulator's own page on 11 October 2026.

Last checked 11 October 2026. The Hong Kong column describes a regime in transition: check it again before you rely on it.

Terms used in this guide

• VASP Virtual asset service provider: VARA's term for a firm that it licenses.
• DPT Digital payment token: the Payment Services Act's term for what MAS guidance also calls a cryptocurrency.
• Cold wallet In PS-G03, a system that is not connected to the internet or to any other form of wireless communication.
• Rehypothecation Re-use of a client's assets by the firm that holds them, for example as collateral for its own borrowing.
• VATP Virtual asset trading platform: the business that the SFC licenses in Hong Kong.
• TCSP Trust or company service provider: a business licensed by the Companies Registry under Cap. 615.
• Authorized institution The HKMA's term for the banks and deposit-takers that it supervises.

Dubai: the VARA custody services licence

Crypto custody is regulated in Dubai: a firm needs a licence from the Virtual Assets Regulatory Authority (VARA) before it holds virtual assets for clients in or from the Emirate. VARA was set up under Law No. 4 of 2022 and covers every zone of Dubai except the Dubai International Financial Centre (see About VARA). Its list of licensed activities names eight, and Custody Services is one.

What the licence covers

A custody licence covers the safekeeping of client virtual assets under the Custody Services Rulebook, current since 19 June 2025. Its five parts deal with the board, policies and disclosures, storage and custody (Part III), staking from custody (Part IV) and collateral wallets (Part V). The core of Part III is the section on segregation and control, which makes four points that a client can test against a contract:

• assets in custody are not depository liabilities or assets of the custodian;
• each client's assets sit in separate wallets that hold that client's assets only;
• the custodian keeps control of each asset at all times;
• rehypothecation is not permitted, whether or not the client consents, and the custodian may not ask for consent.

The wallet-management section adds operating rules, among them key and seed backups kept apart from the primary and a mnemonic backup phrase split into at least two parts.

Why custody needs its own legal entity

Custody is the only VARA activity that cannot share a company with other activities. VARA's activities page lets a firm combine several activities under one licence, except custody: a custodian must be a distinct legal entity with a standalone licence. Rule III.B.5 of the rulebook repeats the point, with one limited exception for transfer and settlement services.

That explains group charts. A group that offers custody and brokerage in Dubai shows two companies and two register entries: at Hex Trust, Hex Trust MENA FZE holds the custody licence and HT Markets MENA FZE runs the OTC desk under the Dubai broker-dealer licence.

Staking from custody and collateral wallets

Both services need an explicit authorisation written into the custody licence. Under Part IV of the rulebook, a custodian may stake only if VARA has authorised it and the licence says so, only for assets already in its custody, and from the same legal entity, because VARA treats staking from custody as part of the custody activity. Under Part V, collateral wallet services are open only to licensed custodians, again by explicit authorisation.

A custody licence alone therefore does not show that staking is permitted. Read the entry, and see where institutional staking is and is not offered by Hex Trust.

Marketing and risk-disclaimer rules

Dubai's marketing rules bind anyone who markets virtual assets in or to the UAE, licensed or not. The Regulations on the Marketing of Virtual Assets and Related Activities 2024 have applied since 1 October 2024, and their definition of marketing is wide: the listed channels include educational content such as articles. Under the requirements for marketing, marketing of a virtual asset must carry a prominent disclaimer that the asset may lose its value in full or in part and is subject to extreme volatility, and must state that the investor has no form of financial protection. The footer of this site carries that warning, and the full text is in our risk disclosure and regulator-required warnings.

How to check a VARA licence

Search the VARA public register for the exact legal entity name, not the brand. An entry gives the name, address, reference (in the pattern VL/23/08/002), licence type, licensed activities, issue date, licence condition and status. The entry for Hex Trust MENA FZE on the VARA public register, read on 11 October 2026, shows a VASP Licence for Custody Services issued on 15 November 2023, with the status Active and the condition that the firm may serve Institutional Investors and Qualified Investors.

Singapore: MAS and the Payment Services Act

Singapore regulates crypto custody as a payment service: a firm that safeguards digital payment tokens for customers needs a licence from the Monetary Authority of Singapore (MAS), or an exemption under the Act. The statute is the Payment Services Act 2019, which Parliament passed on 14 January 2019.

Digital payment token services

Custody came into the Act's scope on 4 April 2024. On that day, according to the MAS notification on the expanded scope of the Payment Services Act, the digital payment token (DPT) service grew to include safeguarding a token or a DPT instrument that the provider controls, and carrying out a customer's instructions on it. Firms already doing this had to notify MAS by 4 May 2024 and apply for a licence before 4 October 2024. Before then the Act covered dealing in tokens and facilitating their exchange.

The Major Payment Institution licence

A Major Payment Institution may provide any combination of regulated payment services with no ceiling on volume. The Act's page lists three licence classes: Money-changing Licensee, Standard Payment Institution and Major Payment Institution. The MAS directory describes the major class as subject to more comprehensive regulation than the standard class, because the scale of its operations poses greater risks. The licence class does not say which services a firm offers: for custody, the directory entry must list the Digital Payment Token Service.

Consumer-protection and safeguarding guidelines

MAS sets out its custody expectations in the Guidelines on Consumer Protection Measures by DPT Service Providers (PS-G03), issued on 2 April 2024 and last revised on 19 September 2024. Chapter 3, on safeguarding customers' assets, took effect on 4 October 2024. It expects a provider to:

• hold customers' assets in a trust account, kept by itself or by another safeguarding person;
• use different blockchain addresses for customers' assets and for its own;
• make sure that no single individual can authorise and carry out a movement of customers' assets;
• keep the instruments for at least 90% of customers' assets in cold wallets at all times;
• send each customer a monthly statement of account, unless the customer sees the records in real time or has opted out in writing;
• not lend or stake the assets of a retail customer, a class that excludes institutional investors and accredited investors who have opted in;
• give other customers a written risk disclosure, and take their written acknowledgment, before lending or staking their assets.

PS-G03 calls itself general guidance that does not replace the Act or the Payment Services Regulations, where the segregation duty itself sits. Where multi-party computation is used, it expects key shares to sit with different parties so that none can move assets alone. Our guide to HSM, MPC and multisig custody compared explains the models.

Limits on promoting DPT services

MAS expects providers not to promote DPT services to the general public in Singapore. The PS-G02 guidelines, published on 17 January 2022, rule out advertising in public areas, on third-party websites and social media platforms, and through influencers. A provider may use its own website, applications and official social media accounts if it does not trivialise the risks.

Notice PSN08 on disclosures and communications, last revised on 2 April 2024, prescribes a risk warning that tells the customer two things: a licence does not mean that all money or tokens can be recovered if the provider fails, and MAS does not supervise a provider's unregulated services.

How to check the MAS Financial Institutions Directory

Search the directory for the institution's legal name. An entry shows the licence type and status, the regulated services, key personnel and contact details. The entry for Hex Technologies Pte. Ltd. in the MAS Financial Institutions Directory, read on 11 October 2026, shows a Major Payment Institution with two services: Cross-border Money Transfer Service and Digital Payment Token Service. It showed no licence number, so match the name and the address and ask the firm for the number.

Hong Kong: platform custody, bank standards and the proposed custodian licence

Hong Kong had no licence for standalone virtual asset custodians in force on 11 October 2026. Custody was regulated in two places only: inside trading platforms licensed by the Securities and Futures Commission (SFC) and at banks supervised by the Hong Kong Monetary Authority (HKMA). A dedicated regime is proposed, and each statement about it below carries its date.

What is licensed today: custody inside SFC-licensed trading platforms

The SFC licenses custody today only as part of a trading platform. Its page on virtual asset trading platform operators, read on 11 October 2026, says that centralised platforms that carry on business in Hong Kong, or actively market to Hong Kong investors, must be licensed under the Securities and Futures Ordinance (Cap. 571) and the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). The licensing scope covers platforms that match client orders and provide custody as an ancillary service to trading. The Government dates that regime to June 2023.

HKMA standards for banks

Banks follow supervisory standards, not a custody licence. The HKMA circular Provision of Custodial Services for Digital Assets, issued on 20 February 2024, sets expected standards in an annex for authorized institutions and for subsidiaries of locally incorporated ones, whether the assets arrive through their work as virtual asset intermediaries, the distribution of tokenised products or standalone custody. The annex expects client assets to sit in client accounts that are segregated from the institution's own. The circular applies to those institutions only.

What a TCSP licence is and is not

A TCSP licence is an anti-money-laundering licence for trust or company service providers. The Registry for Trust and Company Service Providers, part of the Companies Registry, grants it under Cap. 615, publishes a licensing guideline (May 2025) and an anti-money-laundering guideline for licensees (March 2025), and keeps the public register. Its home page, read on 11 October 2026, does not mention virtual assets or custody.

The accurate status line for a holder is therefore: TCSP licence (AML), not an SFC-licensed platform. No source read for this guide says that a TCSP licence or a trust company registration authorises the custody of virtual assets, so this guide does not say it. Hex Trust's trust centre lists both items for Hong Kong, without a number or the holder's name.

The proposed licensing regime for virtual asset custodians

The proposal would have the SFC license and supervise virtual asset custodians under Cap. 615. Two dated steps lead to it:

• 27 June 2025. The Financial Services and the Treasury Bureau (FSTB) and the SFC opened a joint consultation on regimes for virtual asset dealers and custodians, with comments due by 29 August 2025.
• 24 December 2025. They published their consultation conclusions after 93 submissions on the custodian proposal. The regime will focus on the risks of safekeeping the private keys of client virtual assets in Hong Kong. The SFC's release of the same day placed it under Cap. 615, aimed for a bill in 2026 and invited firms to start pre-application discussions.

As background, the SFC's regulatory roadmap of 19 February 2025 had aimed to complete legislative preparations by the end of 2025. That target has passed.

Status on 11 October 2026 and what to watch

On 11 October 2026 the proposed custodian licence was not law. In the Government press release of 26 May 2026, the latest official statement, the FSTB and the SFC were finalising the proposals for the dealing, custodian, advisory and management regimes and aimed to introduce the bill within the year. The release names trading platforms and stablecoin issuers as the existing licensing regimes.

The Legislative Council Bills Database (open data, 40 newest bills), queried on 11 October 2026, listed no bill that, by its title, amends Cap. 615 or deals with virtual asset dealing or custody. Its newest bills were gazetted on 2 October 2026. Watch for the gazettal of the bill, the SFC's guidance for applicants and any transitional period for firms that already hold client assets.

How to check the TCSP register

Search the Register of Trust or Company Service Provider Licensees by licensee name or licence number on the registry's site, after accepting its terms of use. A match confirms an anti-money-laundering licence and nothing more. For a trading platform, use the lists on the SFC page linked above.

What a licence does not tell you

A licence tells you who supervises one named company for one named activity on a given date. It says less than many readers assume, in four ways.

• Licence scope is not product scope. A group website can show services that its licensed company in your market does not offer. The warning prescribed by MAS says that it does not supervise a provider's unregulated services.
• Segregation lowers a risk and does not remove it. The risk warning that Hex Technologies Pte. Ltd. prints because MAS requires it says that a trust account or segregated account may not fully protect money or tokens if the business fails.
• No protection scheme stands behind the assets. VARA's marketing rules require firms to state that an investor in virtual assets does not benefit from any form of financial protection.
• A licence is not an audit of controls. Key management, insurance, reporting and exit terms still need their own review. Our due diligence checklist for appointing a custodian lists the questions.

How Hex Trust is licensed in each market

Hex Trust is licensed through separate companies in Dubai and Singapore, and in Hong Kong it lists a trust company registration and a TCSP licence. The table maps each company to its regulator, licence number and register entry, as read on 11 October 2026.

Last verified 11 October 2026 against the two VARA entries and the MAS directory entry. The TCSP register search was not run.

Three limits follow from these entries. The two Dubai companies may serve Institutional Investors and Qualified Investors only. The Singapore company does not serve retail consumers, and its OTC execution is open only to verified accredited and institutional investors. Wealth management (Aura), token wrapping, wXRP and DPT lending or staking appear on the global Hex Trust website, but they are not offered in Singapore or Dubai and are not regulated by MAS or under VARA.

Brokerage in Dubai follows its own rulebook, the Broker-Dealer Services Rulebook, current from 19 June 2025, whose Part II sets the trading and execution rules.

For the service behind the custody licences, see institutional crypto custody from licensed entities. The companies are described under the Hex Trust legal entities, the full record is in Hex Trust licences and regulatory disclosures, and redress is set out in the complaints routes by entity.

Check any custodian on the register in five steps

A register check takes five steps and needs no help from the custodian. Repeat it on a schedule, because a status can change after a contract is signed.

1. Get the exact legal entity name

   Take it from the draft contract or from the legal notice on the firm's site. A brand name is not a licensee.

2. Open the regulator's own register

   Go to the regulator's site yourself: the VARA public register, the MAS Financial Institutions Directory, the SFC's platform lists or the TCSP register. Do not rely on a screenshot or a badge.

3. Match the licence number

   Compare the number, the entity name and the address with the contract. Where the register shows no number, match the name and the address and ask the firm for the number in writing.

4. Read the permitted activities and client classes

   Custody and brokerage are separate activities in Dubai, and staking needs its own authorisation. A licence condition may exclude your class of client.

5. Check the status and the date

   Record the status, the issue date and the date of your own check. Check again at each contract renewal and after any notice from the regulator.

What this guide does not cover

This guide covers three regimes and stops there. It does not cover the Abu Dhabi Global Market, the Dubai International Financial Centre, the European Union's Markets in Crypto-Assets Regulation or the United States. Nor does it cover tax, accounting treatment or the insolvency law that decides who owns assets held by a failed custodian.

Hex Trust's press releases record two older European steps: entry in the Italian registry of virtual asset service providers kept by the Organismo Agenti e Mediatori (release of 12 July 2022) and a digital asset service provider registration in France (release of 2 August 2023). They are reported here as history only: no current page of the live site names an EU entity, and the present status of both is unconfirmed.

FAQ

Sources

Eight primary sources, each read on 11 October 2026 and opened again on 12 October 2026, while this page was built. Registers, SFC releases, other MAS documents and the bills database are linked where the text relies on them.

1. Virtual Assets Regulatory Authority, Licensed Activities, opened 11 and 12 October 2026.
2. Virtual Assets Regulatory Authority, Custody Services Rulebook, effective from 19 June 2025, opened 11 and 12 October 2026.
3. Monetary Authority of Singapore, Payment Services Act 2019: overview and related documents, opened 11 and 12 October 2026.
4. Monetary Authority of Singapore, Guidelines PS-G03, revised on 19 September 2024, opened 11 and 12 October 2026.
5. Companies Registry, Hong Kong, Registry for Trust and Company Service Providers: home page, opened 11 and 12 October 2026.
6. Hong Kong Government, press release of 24 December 2025 on virtual asset dealing and custodian services, opened 11 and 12 October 2026.
7. Hong Kong Government, press release of 26 May 2026 on virtual asset advisory and management services, opened 11 and 12 October 2026.
8. Hong Kong Monetary Authority, circular of 20 February 2024 on custodial services for digital assets, opened 11 and 12 October 2026.