Which regulator protects your crypto depends on the legal entity that onboarded you, not the app you log into. When an exchange merges its regional platforms, the interface consolidates but the licences do not. A Dubai user’s protection comes from VARA rules applied to the VARA-licensed entity — not from the group’s Hong Kong licence.
Key takeaways
- HashKey merged its Hong Kong, Singapore, Middle East and Bermuda platforms into one app in July 2026, under a model it calls “unified entry, localized compliance.”
- One app does not mean one licence. Four jurisdictions, four regulators, four separate sets of client-asset rules.
- HashKey’s announcement names its Hong Kong licences precisely and does not name the regulator, licence or entity for Singapore, Dubai or Bermuda.
- It also does not say which entity holds client assets — the single question that matters most when platforms consolidate.
- Under VARA’s rules, a Dubai custody provider must be a separate legal entity from the rest of the group. The regulation makes “one entity” impossible by design.
What actually merged at HashKey — and what did not
In July 2026, HashKey Holdings folded its two consumer applications — HashKey Exchange and HashKey Global — into a single trading app. The company describes the result as integrating “core jurisdictional hubs including Hong Kong, Singapore, the Middle East (Dubai), and Bermuda.”
What merged is the front end. What did not merge is the licensing.
HashKey is explicit about this, in language worth reading carefully. Its operating principle is “unified entry, localized compliance,” and its underlying services “remain strictly bound to local regulatory frameworks through rigorous localized management.”
Translated: you download one app, and the legal entity you are actually contracting with is decided by where you are onboarded. That entity, not the app, determines which rulebook governs your assets and which authority you complain to when something goes wrong.
Why one app cannot mean one licence
There is no such thing as a global crypto exchange licence. There are national and free-zone licences, each with its own capital requirements, custody rules and complaint procedures, and none of them recognises the others.
This is sharpest in the UAE, which does not have one crypto regulator. It has three regimes operating inside one country: VARA for Dubai, the FSRA for the Abu Dhabi Global Market, and the federal SCA for the onshore mainland outside the financial free zones. A licence from one does not authorise operation under the others.
So when a group with licences in four jurisdictions puts them behind one login, the question is not “is this exchange regulated?” It is “which of its regulated entities is holding my money, and under whose rules?”
Which HashKey entity holds which licence?
Assembled from each regulator’s own record, because the announcement does not provide it:
| Jurisdiction | Entity named | Regulator | Licence |
|---|---|---|---|
| Hong Kong | HashKey Exchange | Securities and Futures Commission | VASP under the AMLO; Type 1 (dealing in securities) and Type 7 (automated trading services) under the SFO |
| Singapore | HashKey Technology Services (HashKey OTC) | Monetary Authority of Singapore | Major Payment Institution under the Payment Services Act 2019, for digital payment token services |
| Bermuda | HashKey Bermuda Limited | Bermuda Monetary Authority | Class F under the Digital Asset Business Act 2018 |
| Dubai | Not stated in the announcement | Virtual Assets Regulatory Authority | Crypto exchange and crypto dealer licence, live 19 May 2025 |
Two details in that table matter more than they look.
First, Singapore’s licence is a payment institution licence, not an exchange licence. A Major Payment Institution authorisation under the Payment Services Act covers digital payment token services. It is a different permission, with different protections, from the Hong Kong exchange licences — and it is held by a different entity, HashKey Technology Services.
Second, the Dubai entity is not named in the announcement at all. HashKey’s VARA licence went live on 19 May 2025 and covers exchange and dealer activity. Which legal person holds it, and whether that same person holds your assets, is not disclosed in the merger materials.
What VARA actually requires of a Dubai custody provider
This is where the UAE framework does something the marketing language cannot.
VARA’s Custody Services Rulebook (Part III — VA Storage and Custody Rules, Section B — Segregation and Control) sets requirements that legal analyses of the rulebook consistently describe as follows:
- Client assets must be segregated into separate wallets. Firms qualify for a custody licence only if each client’s virtual assets sit in a wallet containing that client’s assets alone.
- Rehypothecation is prohibited outright — a custody provider may not lend out or reuse client virtual assets, and cannot do so even with the client’s consent.
- Custody must sit in a separate legal entity from any group member conducting other virtual asset activities.
Read that third point again next to the phrase “unified platform.”
Under VARA’s own rules, a group cannot hold Dubai clients’ assets in the same legal entity that runs its other virtual asset businesses. The regulation forces structural separation. So however unified the app becomes, the entity holding a Dubai user’s assets is required to be a distinct one — and the protection attaching to those assets flows from VARA’s rules applied to that entity, not from the group’s brand.
That is a feature, not a technicality. Segregation and the rehypothecation ban are precisely the protections whose absence turned earlier offshore exchange failures into total client losses.
Which regulator protects your crypto: four checks
Platform consolidation is not a risk in itself. It is usually a cost and engineering decision, and a unified app is genuinely easier to use. The risk is that a single interface makes four different legal positions look like one.
Four checks, none of which require you to trust marketing language:
- Find the entity name in your terms of service, not the app store listing. The counterparty named in the agreement you accepted is the one that owes you your assets.
- Match that entity to a licence on the regulator’s own register. VARA publishes its licensed firms; so do the SFC, MAS and BMA. A group licence somewhere else is not your licence.
- Ask which entity holds custody, and whether it is separate from the trading entity. Under VARA rules it must be. If a platform cannot answer this quickly, that is information.
- Check what happens on withdrawal limits and complaints. Your escalation path runs to your entity’s regulator. A Dubai user’s route is VARA — not Hong Kong’s SFC, however prominently that licence appears in the announcement.
For the current picture of who holds what in Dubai, our UAE VARA-Licensed VASPs tracker lists firms with live licences. The VARA VASP Licence guide covers what each licence category actually permits, and the broader UAE crypto regulation guide explains how VARA, ADGM and the SCA divide the territory between them. HashKey is not unusual here — Revolut’s VARA approval raised the same entity question for a far larger user base.
The disclosure gap worth naming
One observation about the announcement itself.
HashKey names its Hong Kong permissions with precision — the AMLO VASP registration, Type 1, Type 7, the SFO. That is a company that knows how to describe a licence.
The same document does not name the regulator or the licence for Singapore, Dubai or Bermuda. It does not identify which entity holds client assets. And it cites “industry-leading digital asset insurance coverage” without naming the insurer, the policy limit, or what it covers.
None of that is a violation of anything. Press releases are marketing. But the gap between the precision applied to one jurisdiction and the silence applied to the other three is the most useful thing in the document — and it is exactly the information a user of a newly merged platform needs.
Ask for it. Which regulator protects your crypto is a question a regulated firm can answer in one email — and the answer should name an entity, not a brand.
Frequently asked questions
Which regulator protects my crypto on a multi-jurisdiction exchange?
The regulator of the legal entity that onboarded you. If you were onboarded by a Dubai entity, VARA’s rules apply to your assets. A licence the group holds in Hong Kong, Singapore or Bermuda does not extend protection to you.
Does HashKey have a UAE licence?
Yes. HashKey’s crypto exchange and crypto dealer licence from Dubai’s Virtual Assets Regulatory Authority went live on 19 May 2025. The announcement of the app merger does not name the legal entity holding it.
Can one company hold my crypto and run the exchange in Dubai?
Not for custody. VARA requires a custody services provider to be a separate legal entity from any group member conducting other virtual asset activities, and prohibits rehypothecation of custodied assets even with client consent.
Is a Singapore MPI licence the same as an exchange licence?
No. A Major Payment Institution licence under Singapore’s Payment Services Act 2019 authorises digital payment token services. It is a different authorisation, held by a different HashKey entity, from the exchange licences the group holds in Hong Kong.
Sources
- HashKey Group — HashKey Exchange Launches New Flagship Crypto Trading App
- VARA — Custody Services Rulebook
- Cointelegraph — Hong Kong crypto giant HashKey merges regional exchange into one, 27 July 2026
- Monetary Authority of Singapore — Major Payment Institution licence, Payment Services Act 2019
- Bermuda Monetary Authority — Class F licence, Digital Asset Business Act 2018
- Hong Kong Securities and Futures Commission — VASP registration under the AMLO; Type 1 and Type 7 under the SFO
- HashKey Group — HashKey’s Compliance Journey
This is journalism and analysis, not legal or regulatory advice. Rules change and supervisory interpretation varies. Verify any position with qualified counsel in the relevant jurisdiction before relying on it.
