HashKey Exchange Achieves SOC 1 Type 2 and SOC 2 Type 2 Certifications

(HONG KONG, May 8, 2025) HashKey Exchange, the largest* licensed virtual asset exchange in Hong Kong, today announced that HashKey Custody Services Limited** (abbreviated as “HashKey Exchange”) has achieved the SOC 1 Type 2 Certification and SOC 2 Type 2 Certification. The certification reinforces HashKey Exchange's role as a trusted partner for institutional and retail clients seeking compliant, enterprise-grade solutions.

The certification reports include the auditor's opinion affirming the suitability and operational effectiveness of controls, defined control objectives aligned with security, availability, and confidentiality criteria, rigorous testing methodologies including inspections and risk assessments, and evidence of consistent control effectiveness throughout the audit period.

The scope of the certification provides reasonable assurance that HashKey Exchange's service commitments and system requirements are achieved based on the Trust Services Criteria relevant to security, availability, and confidentiality ("applicable trust services criteria") set forth in TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, under the AICPA Trust Services Criteria.

This achievement is significant, reflecting a well-designed system that provides reliable, secure, and resilient services for users across HashKey Exchange's platforms, including digital asset trading, custody, and asset management solutions. The SOC 1 Type 2 audit assessed HashKey Exchange's controls over a specified timeframe, confirming ongoing effectiveness in ensuring financial reporting accuracy, maintaining data integrity, and complying with regulatory requirements. The SOC 2 Type 2 audit evaluated HashKey's controls over an extended period, ensuring consistent operational effectiveness in safeguarding client data, mitigating risks, and maintaining system uptime.

The certification builds on HashKey Exchange's existing compliance framework, which includes ISO 27001 (information security management) and ISO 27701 (privacy information management), positioning HashKey Exchange as a high-level global digital asset service provider able to meet such rigorous, multi-layered standards.

The SOC 1 Type 2 Certification is accordance with International Standard on Assurance Engagement 3402, Assurance Reports on Controls at a Service Organisation ("ISAE 3402"), issued by the International Auditing and Assurance Standards Board ("IAASB"). SOC 2 Type 2 Certification based on the AICPA's Trust Services Criteria. Both are rigorous compliance reports verifying that an organization's controls operate effectively over a sustained period. These reports are issued by independent auditing firms accredited to assess and attest to the operational reliability of these controls.

*As of January 31, 2025, HashKey Exchange ranks 7 on CoinGecko’s global exchange list and is the highest-ranked licensed virtual asset exchange in Hong Kong.

**Note: HashKey Custody Services Limited serves the sole purpose of safeguarding custodial clients' assets for HashKey Exchange, which can be referred to simply as HashKey Exchange.

About HashKey Exchange

On a mission to set the bar for virtual asset exchanges in compliance, safety, and security, HashKey Exchange (HBL) was granted as a licensed virtual asset exchange to provide retail services in Hong Kong. HashKey Exchange has received approval from the Securities and Futures Commission (SFC) of Hong Kong to operate a virtual asset trading platform under Type 1 (Dealing in securities) licence, Type 7 (Providing automated trading services) licence and Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) licence. As HashKey Group's flagship exchange business, HashKey Exchange provides trading services for both professional investors (PI) and retail investors. HashKey Exchange has obtained ISO 27001 (Information Security) and ISO 27701 (Data Privacy) management system certifications. HashKey Exchange does not service users from Mainland China, United States and certain other jurisdictions in compliance with laws and regulations. This material has not been reviewed by the Securities and Futures Commission of Hong Kong or any other regulator. Stay tuned for more details about HashKey Exchange. Follow us on Twitter and LinkedIn. For media enquiries and more information, please contact: jade.shi@hashkey.com Disclaimers