Guardianship Handoff Failure in Cryptoasset Cybercrime: Regulatory Discontinuity, Digital Financial Victimisation, and Cross-Border Crime Prevention

Abstract

Cyber-enabled fraud can move victim funds from social or messaging platforms into banks, virtual-asset service providers, self-hosted wallets, cross-chain services and offshore venues before a report becomes effective preservation or restraint. This article asks why prevention and recovery can fail even when formally capable guardians exist at successive institutional nodes. It develops guardianship handoff failure (GHF) as a transition-level criminological mechanism: a handoff fails when a relevant downstream guardian exists or can lawfully be activated, but the information, attribution, legally usable authority or intervention capacity needed for that guardian’s function is not preserved, transmitted, recognised or activated within the relevant temporal window. GHF is distinguished from the absence of guardianship, substantive gaps in legal power and lawful non-intervention. Using a structured comparative socio-legal design and a crime-script-informed sequence, the study examines seven recurrent handoff zones in Hong Kong and South Korea to a legal cut-off of 30 September 2026. The analysis identifies four non-exclusive discontinuities—observability, attribution, authority and intervention—and derives four propositions for later empirical testing. The comparison illustrates conditions consistent with the proposition that denser regulatory coverage may increase coordination dependence, without estimating causal effects on victim loss or recovery. A victim-centred architecture is proposed that separates evidence preservation, temporary restriction, public restraint, adjudication and return while emphasising accessible reporting, provenance, bounded escalation, correction and protection against secondary victimisation.

1. Introduction

Cyber-enabled financial fraud increasingly joins online deception to rapid asset movement. Investment scams, romance-linked investment fraud, phishing and fraudulent trading interfaces can begin on social or messaging platforms, pass through bank or card funding, and then move into cryptoassets and across multiple service environments before the victim or an intermediary recognises the loss (Maras and Ives 2024; Asyalı et al. 2026). The prevention problem therefore does not end when the deceptive act succeeds. It continues through the post-transfer infrastructure that determines whether a warning can be converted into evidence preservation, temporary interruption, formal restraint and, ultimately, recovery.

For a victim, minutes or hours can separate a reversible transaction path from an effectively irreversible loss. Yet no single actor necessarily sees the whole event. A communications platform may hold the deceptive account and message history; a bank may see fiat funding; a virtual-asset service provider (VASP) may identify the customer and destination address; a blockchain-analytics provider may detect downstream exposure; and police or a financial-intelligence unit may hold reports linking the event to other complaints. Each actor may be competent within its own mandate while the system fails at the transition between them.

This article addresses that transition problem. Its explanatory question is: under what conditions does guardianship become discontinuous when suspicious value or a victimisation signal moves across functional, institutional, or jurisdictional boundaries? The article develops guardianship handoff failure (GHF) as a criminological mechanism and distinguishes it from generic institutional fragmentation, regulatory silos, information asymmetry, public-private policing gaps and the simple absence of legal powers. Those concepts identify important structural problems. GHF adds a more specific unit of analysis—the transition at which a receiving guardian must inherit, reconstruct, recognise or activate enough capability to act before the relevant opportunity changes.

The article has three analytically distinct but sequential objectives. First, it develops and bounds the GHF construct. Second, it uses Hong Kong and South Korea as structured comparators to examine how handoff conditions appear across seven recurrent transition zones. Third, on the basis of those observations and the theoretical framework, it identifies design principles for a victim-centred prevention and recovery architecture. The comparison is not designed to prove that one jurisdiction performs better, nor does it estimate whether any particular arrangement reduces losses. Its role is to expose variation in legal status, institutional interfaces and observable operational practices that makes the handoff mechanism analytically visible.

The study also separates four evidentiary levels that were too easily blended in earlier formulations of the argument. Documentary observations describe what statutes, regulations, official guidance and published operational materials establish. GHF interpretations apply the conceptual framework to those observations. Propositions state hypotheses that require later testing with case, transaction or institutional performance data. Recommendations are normative proposals informed by the diagnosis but not presented as effects demonstrated by this study. This separation is especially important where recent reforms have been enacted but have not yet commenced.

The article proceeds as follows. Section 2 develops the theoretical framework and the boundary conditions of GHF. Section 3 sets out the comparative design, documentary corpus, coding rules and legal cut-off. Section 4 distinguishes operative rules from proposed or delayed reforms in Hong Kong and South Korea. Section 5 applies the framework to seven handoff zones and incorporates law-in-action material where public evidence exists. Section 6 and Section 7 discuss the propositions, victim-centred architecture, evaluation strategy and legal safeguards. Section 8 states the limitations, and Section 9 concludes.

2. Theoretical Framework: From Capable Guardianship to Handoff Capability

2.1. Cybercrime, Digital Victimisation and Continuous Guardianship

Routine activity theory directs attention to the convergence of a motivated offender, a suitable target and the absence of capable guardianship (Cohen and Felson 1979). In cybercrime, however, guardianship is distributed across technologies, firms and public bodies. A victim may receive a warning from a platform while the relevant funds are held by a bank; a VASP may identify a suspicious destination while only a public authority can compel records or maintain coercive restraint. The meaningful question is therefore not only whether a guardian exists at a particular node, but whether effective guardianship remains continuous while the event changes institutional context.

Guardianship scholarship has already moved beyond a purely physical understanding of a capable guardian. Leclerc and Reynald (2017) show how crime scripts can be combined with guardianship analysis to identify the stages at which intervention is feasible, while research on online illicit markets demonstrates that cyber offending depends on sequences of technical and human decisions rather than on a single unguarded moment (Hutchings and Holt 2015). In cryptoasset-enabled fraud, this point has an institutional corollary: a guardian can be capable at one stage yet incapable at the next because the information, identity link, authority or control necessary for action has not followed the event.

Digital-victimisation scholarship reinforces this point. Online fraud can generate financial loss, shame, self-blame and continuing psychological harm; prevention that focuses only on victim caution can reproduce victim-blaming while ignoring institutional capacity to respond after a reliable warning emerges (Drew and Webster 2024; Whittaker et al. 2024). In fast-moving asset environments, post-report institutional delay may become part of the victimisation process because repeat transfers, dissipation and recovery scams can occur after the initial report.

A victimological perspective also changes the analytical meaning of delay. Once a credible report or warning exists, institutional continuity can shape whether harm remains bounded or becomes iterative. A delayed or incomplete handoff may leave a victim exposed to additional transfers, reduce the chance of time-sensitive preservation, and increase the burden of seeking assistance across fragmented institutions. Repeated retelling, uncertainty over institutional responsibility, opaque status communication and inaccessible recovery procedures may generate forms of secondary victimisation after the original deception has ended. Recoverability is therefore partly path-dependent: if evidential context, attribution or a usable preservation pathway is lost at a transition, a victim may encounter a recovery barrier even though individual institutions remain formally capable within their own mandates. On this account, GHF is not only a mechanism of institutional discontinuity; it is also a mechanism through which institutional responses can affect the duration and consequences of victimisation. This places victim protection within the explanatory scope of GHF rather than treating it solely as a downstream policy objective.

Crime-script analysis offers a complementary temporal lens. Scripts decompose offending into stages, resources, decisions and intervention points rather than treating an offence as a single event (Cornish 1994; Borrion 2013; Dehghanniri and Borrion 2021). Financial-crime scripting similarly emphasises the organisation of profit, movement and concealment across stages (Gilmour 2023; Snaphaan and van Ruitenburg 2025). This article therefore uses crime-script reasoning to locate when the guardian sequence intersects with the offender sequence. It describes the method as crime-script-informed conceptual analysis because the documentary evidence does not reconstruct a representative sample of completed offender scripts.

Recent research also shows why a staged approach matters in the Korean context. Choi and Lee (2026) identify a multi-stage script in cryptocurrency investment fraud, while Mat Isa et al. (2025) use routine activity theory to examine persistent money-laundering exposure in banking. These studies do not establish GHF, but they support the premise that opportunities and control points vary across stages and institutional settings rather than remaining static throughout an offence. Table 1 contrasts node guardianship with handoff guardianship.

Table 1. Node guardianship and handoff guardianship.

Dimension	Node Guardianship	Handoff Guardianship
Unit of analysis	An actor, institution, platform, or regulated node	A transition between actors, systems, functions, or jurisdictions
Core question	Can this guardian observe or control the relevant event?	Does the capability needed by the next guardian survive or become reconstructable in time?
Typical evidence	Mandate, surveillance, customer data, custody, legal power	Event identifiers, provenance, referral records, authenticated requests, recognition/activation steps
Failure condition	Guardian absent or incapable at the node	A relevant downstream guardian exists or is lawfully activatable, but required capability is lost or not activated within the relevant window
Policy implication	Add or strengthen a control node	Design the interface, provenance, escalation, and lawful activation between nodes

2.2. What GHF Adds to Fragmentation and Coordination Accounts

Institutional fragmentation, regulatory silos and public–private coordination failures are well-recognised problems in economic crime governance. Economic criminology itself has been framed as an attempt to bridge disciplinary and professional silos surrounding financially motivated offending (Button and Shepherd 2023; Hock and Ryder 2023; Lord and Levi 2023). These accounts explain why responsibility can be divided and why coordination can be costly. GHF is narrower. It asks whether the specific capability required for the next guardian’s task survives a transition at the time it is needed.

Money-laundering research likewise recognises displacement, professionalisation and adaptation to control (Levi and Reuter 2006; Akartuna et al. 2025). Those perspectives explain why offenders select channels and reorganise flows when controls tighten. GHF addresses a different question: what happens to guardianship when the same risky value moves between those channels? The construct is therefore neither a general theory of money laundering nor a label for regulatory arbitrage. It specifies a transition-level failure condition that can be coded independently of whether the underlying route was chosen to evade regulation.

The additional analytical leverage has four elements. First, the unit of analysis is the handoff rather than the institution. Second, time is constitutive rather than incidental: information that arrives after irreversible withdrawal may be accurate but operationally useless. Third, the framework separates observation from intervention. The actor that best sees the risk may not have the legal or technical capacity to preserve value. Fourth, GHF is provenance-sensitive. A warning can survive semantically while losing the evidential basis, confidence, source or legal status needed by the recipient to rely on it. Thus, two systems with the same formal distribution of institutions can differ in handoff capability.

This distinction also prevents GHF from becoming a synonym for ‘poor coordination’. Coordination may be imperfect without producing a relevant failure, and institutional differentiation may operate effectively if the receiving actor obtains or can reconstruct what it needs within the relevant time window. Conversely, a highly coordinated system can still experience GHF if a crucial attribution link or legal basis disappears at one transition.

2.3. Definition, Boundary Conditions and the Four Discontinuities

GHF occurs when (1) a meaningful victimisation or risk event crosses a functional, institutional or jurisdictional boundary; (2) a relevant downstream guardian exists, or can lawfully be activated, for the next preventive, evidential or coercive function; (3) that guardian requires information, attribution, legal usability or intervention capacity generated or available upstream; and (4) the required capability is not preserved, transmitted, recognised, reconstructed or activated within the temporal window in which it could still perform that function. The definition therefore contains both a transition condition and a counterfactual capability condition.

Several adjacent conditions fall outside the construct. If no institution has any lawful power to perform the relevant function, the primary problem is a substantive regulatory or jurisdictional gap, not a handoff failure. If an actor lawfully decides not to intervene because the evidential or statutory threshold is not met, that is lawful non-intervention unless the threshold failure itself resulted from a defective handoff. If an apparently decentralised protocol has no identifiable person with practical control, the absence of a controllable guardian is not converted into GHF by metaphor. GHF becomes relevant again when the value reaches a controllable interface such as a custodian, VASP, issuer or fiat gateway.

The framework uses four non-exclusive diagnostic dimensions. Observability discontinuity concerns loss of the context that made an event suspicious. Attribution discontinuity concerns loss or degradation of the link among person, account, wallet, device, transaction or predicate event. Authority discontinuity concerns failure to transmit, recognise or activate legally usable authority—for example, a preservation request that cannot be authenticated or a foreign measure that requires domestic validation. Intervention discontinuity concerns loss of a practically deployable means of preventing onward movement or preserving the status quo before formal adjudication. More than one code can apply to the same event.

The codes are diagnostic rather than mutually exclusive causal categories. For later empirical coding, the primary discontinuity should be the earliest coded break that is independently necessary to explain why the downstream guardian could not perform the specified function; additional codes should be retained because failure can cascade. Missing information is usually an observability problem, but becomes an attribution problem where the missing element is identity linkage. A complete absence of legal power is normally outside GHF, whereas failure to activate an available domestic power or to recognise a legally permissible request is an authority handoff problem. Operational delay is GHF only when it occurs at a qualifying transition and defeats an otherwise available function. Table 2 summarises the operational definitions and documentary indicators for the four discontinuities.

Table 2. Operational definitions of the four GHF discontinuities.

Dimension	Operational Test	Typical Documentary Indicator	Not Sufficient by Itself
Observability	Does the receiving guardian retain the context that made the event risky or suspicious?	Loss or truncation of warning basis, timing, confidence, or linked-event context	Different monitoring systems or ordinary institutional specialisation
Attribution	Can the receiving guardian connect the event to the relevant person, account, wallet, device, transaction, or predicate event?	Unusable identifiers, broken provenance, unlinked wallet/account or identity records	Pseudonymity or a self-hosted wallet where no later controllable guardian is implicated
Authority	Can legally usable authority be transmitted, recognised, or activated for the receiving guardian’s function?	Unauthenticated request, unmet recognition step, inability to invoke an available domestic power	A substantive absence of legal power or lawful refusal because the legal threshold is not met
Intervention	Can an otherwise capable guardian deploy a lawful practical measure before the opportunity changes?	Delay or control gap that defeats preservation, temporary restriction, or another available measure	Any delay unrelated to a qualifying transition, or inability caused solely by no guardian having control

2.4. Propositions

Four propositions follow from the mechanism. P1, the handoff-concentration proposition, predicts that the risk of discontinuity increases as the number of functionally meaningful transitions rises, holding other factors constant. P2, the split-capability proposition, predicts greater vulnerability where the actor with the strongest observation is institutionally separated from the actor with the strongest intervention capacity. P3, the interface-visibility proposition, predicts that provenance-preserving event records and interoperable identifiers reduce the effort needed for a receiving guardian to become capable. P4, the reversible-intervention proposition, predicts that legally bounded mechanisms for temporary preservation can reduce the cost of waiting for full coercive authority, subject to safeguards against wrongful restriction.

These are hypotheses, not findings established by the present documentary study. The comparison below can illustrate their plausibility and identify observable institutional conditions, but transaction-level or case-process data are required to estimate effects on detection delay, additional victim loss, wrongful restriction or recovery.

3. Research Design and Comparative Method

3.1. Comparative Logic and Jurisdiction Selection

The study uses structured comparative socio-legal analysis for theory building. Hong Kong and South Korea are selected because they are broadly comparable on several background features relevant to the problem: both are advanced digital economies with sophisticated financial sectors, active cryptoasset markets, formal VASP regulation, exchange-centred AML controls, significant exposure to cross-border transactions and recent policy change. The comparison therefore holds constant the existence of a relatively dense formal control environment rather than contrasting a regulated with an unregulated market.

The cases also contain institutionally meaningful differences. Hong Kong’s core regime developed through an SFC-administered licensing framework for centralised virtual-asset trading platforms under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance, supplemented by securities regulation and an expanding set of SFC circulars. South Korea combines FIU-centred AML registration, real-name banking relationships, a separate Virtual Asset User Protection Act, distinct policing and telecommunications-fraud mechanisms, and separate game-industry regulation. These differences create comparative leverage because similar functions are distributed across institutions in different ways.

The comparison is therefore structured, not outcome-ranked. Each jurisdiction is asked the same handoff questions: who sees the event, what attribution is needed, what legal act must occur, who can intervene, and what evidence shows that the interface operates or remains limited? The object is to identify transition-level variation that would be obscured by two parallel descriptions of national law.

3.2. Documentary Corpus, Period and Legal Cut-Off

The documentary review covers materials published or legally effective between 1 January 2020 and the legal cut-off date of 30 September 2026, while earlier statutes and foundational scholarship are included where necessary to establish the governing framework. The final primary and official corpus used for the structured comparison comprises 26 items: twelve Hong Kong legal, regulatory or policing materials; ten South Korean statutes, decrees, regulatory, policing or prosecutorial materials; and four international standards or official cooperation materials. These are supplemented by peer-reviewed criminological, cybercrime, victimisation and money-laundering scholarship.

Hong Kong materials were retrieved from Hong Kong e-Legislation and Legislative Council materials, the Securities and Futures Commission and the Hong Kong Police Force. South Korean materials were retrieved from the National Law Information Center, Financial Services Commission/Financial Intelligence Unit and National Police Agency. International materials were drawn from FATF’s 2020 red-flag indicators, its 2021 risk-based guidance and 2025 targeted update, together with the US Department of Justice’s 2022 digital-asset cooperation report (Financial Action Task Force (FATF) 2020, 2021, 2025; US Department of Justice 2022). The selection included operative statutes and decrees, binding or supervisory guidance, consultation conclusions where legal status was relevant, and official operational materials that showed law in action. Media summaries were excluded where a primary public source was available.

Superseded material was retained only when needed to identify a change in legal status or commencement. Proposed regimes were not coded as operative rules. Korean statutes, decrees and regulator materials were checked against the Korean originals; English-language government summaries were treated as convenience translations rather than controlling legal text. Where the status of an instrument changed after the cut-off, the paper uses the status existing on 30 September 2026. This is particularly important for South Korea’s August 2026 AML decree and its delayed transfer-related provisions. The issuing authority, publication or promulgation date, commencement position, cut-off status and handoff relevance of the principal recent instruments are reported with the legal-status analysis below, so that prospective measures are not mistaken for operative law.

The corpus is necessarily a public-document corpus. Internal referral protocols, unpublished service-level agreements, proprietary fraud-detection rules and confidential case files are outside the study. Accordingly, absence of public evidence is not treated as proof that no operational mechanism exists.

3.3. Selection of Seven Zones and Coding Procedure

The seven handoff zones were derived iteratively from crime-script scholarship, the functional stages of crypto-enabled fraud and laundering, and repeated interfaces appearing in the documentary materials. They are deliberately non-exclusive and not claimed to be exhaustive. Nor must every incident pass through all seven in sequence. They represent recurrent transitions at which the informational or legal environment changes sufficiently that a receiving actor must undertake a new act of recognition, verification, referral, preservation or coercive activation.

For later measurement, a handoff is counted only when a relevant event crosses at least one functional, organisational, legal-mandate or jurisdictional boundary and the receiving actor must perform a distinct decision or legal act before the next preventive or evidential function can occur. Mere technical routing within the same control environment does not count as a separate handoff. Parallel referrals may therefore create multiple handoffs, while several blockchain transactions within a single controlled service need not.

Each source was entered into a structured comparison matrix. For each zone the analysis recorded: actors; governing provision or official practice; the type of transfer involved (information transfer, referral of responsibility, transmission of a request, recognition of a foreign measure, or activation of domestic power); available evidence of operational implementation; and the four diagnostic codes. Multiple codes were permitted. Where sources were uncertain or contradictory, the more authoritative legal source controlled as to legal status, while operational disagreement was recorded as uncertainty rather than resolved by inference.

A worked coding example illustrates the rule. Suppose a victim reports an investment scam to police, provides a destination wallet, and police transmit an authenticated request to a domestic VASP that still controls the assets. If the VASP can identify the account, preserve records and implement a lawful temporary restriction, no GHF is coded merely because two institutions are involved. If the wallet arrives without the transaction hash and the VASP cannot reliably identify the incoming transfer before onward movement, observability and possibly attribution discontinuity may be coded. If the VASP has the asset but cannot act because the request is unauthenticated despite an available validation route, authority discontinuity may be primary. If all information and authority are present but operational processing takes longer than the withdrawal window, intervention discontinuity may be primary. Table 3 summarises the crime-script-informed sequence and corresponding guardian intersections.

Table 3. Crime-script-informed worked sequence and guardian intersections.

Stage	Offender/Victim Sequence and Resources	Guardian Intersection	Potential Handoff/Intervention Point
1. Contact and grooming	Social/messaging account, impersonation, relationship or investment narrative	Platform observes account, messages, device or complaint data	Platform warning/report → victim-support, bank, police, or fraud-intelligence channel
2. Fiat funding	Victim transfers bank/card funds or purchases cryptoassets	Bank/payment provider sees customer, beneficiary and transaction timing	Fraud warning/report → payment intervention or VASP attribution
3. Cryptoasset acquisition	Funds enter a VASP account and are converted	VASP holds KYC, account, wallet and withdrawal data	Bank/police signal → enhanced review, record preservation, or lawful temporary restriction
4. External transfer	Value moves to self-hosted or overseas wallet/service	Origin VASP sees outgoing transaction; downstream identity may be unknown	Identity/provenance record → later VASP, foreign provider, or authority
5. Layering/route change	Bridge, DeFi, gaming, NFT or multiple wallets alter form or chain	Different services observe fragments of provenance and behaviour	Event identifiers/provenance → next controllable gateway
6. Cash-out or consolidation	Value reaches another VASP, broker, OTC channel, or fiat gateway	Downstream provider can identify customer and movement	Cross-border alert/request → preservation and competent domestic action
7. Report and recovery	Victim or institution reports; investigators reconstruct the route	Police/FIU/court may compel records or restrain property	Private detection → authenticated public process → restraint/adjudication/return

3.4. Evidentiary Status of the Analysis

The analysis distinguishes documentary observation, theoretical interpretation, proposition and recommendation. ‘Observation’ refers to a rule, published procedure, enforcement action or documented institutional practice. ‘Interpretation’ states what that observation suggests when viewed through GHF. ‘Proposition’ states a relationship to be tested later. ‘Recommendation’ is a normative design response. This distinction disciplines causal language: the study does not claim that any proposed architecture has already reduced losses or improved recovery.

4. Legal and Institutional Status at the Cut-Off Date

4.1. Hong Kong

Hong Kong’s operative core is the statutory licensing regime for centralised virtual-asset trading platforms under Part 5B of the AMLO, added by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022 and brought into operation on 1 June 2023, and is administered by the SFC (Hong Kong Special Administrative Region (HKSAR) 2022; Securities and Futures Commission of Hong Kong (SFC) 2023a, 2023b). Licensed VATPs are subject to customer, custody, AML and conduct requirements. In August 2025 the SFC issued additional custody expectations to licensed VATPs (Securities and Futures Commission of Hong Kong (SFC) 2025b), and in November 2025 it permitted qualifying licensed platforms to integrate order books with affiliated overseas platforms subject to specified safeguards (Securities and Futures Commission of Hong Kong (SFC) 2025a). In February 2026 the SFC issued a framework for licensed corporations providing virtual-asset dealing services under omnibus arrangements, including access to shared order books and client-asset safeguards (Securities and Futures Commission of Hong Kong (SFC) 2026a). These were operative supervisory measures at the cut-off.

By contrast, the broader licensing regimes for virtual-asset dealing and standalone custody were still legislative proposals at the cut-off. Consultation conclusions were published in December 2025 with an intention to introduce legislation in 2026 (Securities and Futures Commission of Hong Kong (SFC) 2025c). Advisory and management regimes also remained proposed: consultation conclusions in May 2026 stated that the FSTB and SFC would finalise legislative proposals with a view to introducing a bill in 2026 (Securities and Futures Commission of Hong Kong (SFC) 2026b). These proposals therefore inform prospective handoff analysis but cannot be treated as implemented nodes.

Hong Kong also provides observable law-in-action evidence. The Hong Kong Police Force’s Anti-Deception Coordination Centre operates a multi-agency and public-private model, and its 2025 review records real-time intelligence sharing with banks, scam intervention and fund interception. The same review describes a virtual-asset trading-platform fraud investigation involving more than 2700 victims and losses above HK$1.6 billion; in November 2025, 16 individuals were prosecuted for offences including conspiracy to defraud and money laundering, with the review also recording the first charge for fraudulently or recklessly inducing others to invest in virtual assets (Hong Kong Police Force 2026). Separately, police materials describe an AML seminar with licensed VATPs and a virtual-asset stop-payment mechanism, and the establishment of a Virtual Asset Intelligence Taskforce involving police, regulators and licensed VASPs (Hong Kong Police Force 2025a, 2025c). These materials do not prove the effectiveness of each handoff, but they establish that inter-organisational interfaces are operational rather than purely hypothetical.

4.2. South Korea

South Korea’s operative framework at the cut-off included VASP registration and AML obligations under the Act on Reporting and Using Specified Financial Transaction Information, market-conduct and asset-protection rules under the Virtual Asset User Protection Act, and separate game-industry regulation (Republic of Korea 2001, 2006, 2023). The first-phase User Protection Act had been in force since July 2024. These regimes allocate different functions to the FIU/FSC, VASPs, banks, investigative bodies and other sectoral regulators.

The legal status of the August 2026 AML reforms requires particular care. The amended Specified Financial Transaction Information Act was promulgated on 19 February 2026 with relevant registration provisions commencing on 20 August 2026. The implementing Enforcement Decree was promulgated as Presidential Decree No. 36592 on 18 August 2026. Its general commencement date was 20 August 2026, but the amendments to Article 10-10 and Article 10-20 governing the expanded Travel Rule and additional duties for virtual-asset transfers were expressly delayed until 19 February 2027, six months after promulgation (Republic of Korea 2026a, 2026b; Financial Services Commission of the Republic of Korea (FSC) 2026). Accordingly, as of the 30 September 2026 cut-off, removal of the KRW 1 million Travel Rule threshold and the new overseas-VASP/personal-wallet transfer measures were enacted but not yet operative. Their effects are therefore described prospectively throughout this article.

A separate reform is relevant to victim-centred analysis. Amendments to the Special Act on the Prevention of Loss Caused by Telecommunications-Based Financial Fraud and Refund for Loss extended the statutory architecture to virtual-asset exchanges and virtual-asset transfers, with the principal virtual-asset victim-asset provisions scheduled to commence on 1 October 2026 (Republic of Korea 2026c). Because the cut-off precedes that commencement by one day, the paper treats the statutory recovery mechanism as enacted but not yet implemented evidence.

South Korea nevertheless supplies law-in-action material before those commencements. In June 2026 the National Police Agency announced a cooperation agreement with major domestic VASPs directed at preventing phishing proceeds from being laundered through cryptoassets (Korean National Police Agency 2026). Earlier KoFIU enforcement also demonstrates an operational chain across regulation, investigation and access control: in 2022 KoFIU notified investigative authorities of unregistered foreign VASPs, requested website-access blocking and directed registered providers to suspend transfers with unregistered entities (Financial Services Commission of the Republic of Korea (FSC) 2022). These practices show that cross-institution referral and intervention pathways exist in practice, although they do not establish recovery effects or handoff timeliness.

Law-in-action is also visible in criminal-investigation and asset-preservation practice. In February 2025 the Seoul Southern District Prosecutors’ Office reported that, since the Virtual Asset Crime Joint Investigation Team was established in July 2023, it had opened criminal cases against 74 individuals, with 25 detained, seized KRW 84.9 billion in criminal proceeds and secured KRW 71.2 billion under preservation orders for confiscation or collection (Seoul Southern District Prosecutors’ Office 2025). Those figures establish operational use of investigation, tracing and preservation powers; they do not show whether upstream victim signals were transferred quickly enough, which remains an empirical handoff question. Table 4 summarises the legal status, commencement position and handoff implications of the principal recent instruments in both jurisdictions.

Table 4. Legal-status schedule: publication, commencement and status at 30 September 2026.

Jurisdiction	Instrument and Relevant Provision	Issuing Authority	Publication/Promulgation; Commencement	Status at 30 September 2026	Handoff Implication
Hong Kong	Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022, Ord. No. 15 of 2022, adding AMLO Part 5B; SFC implementation circular and VATP Guidelines (Hong Kong Special Administrative Region (HKSAR) 2022; Securities and Futures Commission of Hong Kong (SFC) 2023a, 2023b)	HKSAR/SFC	Amendment Ordinance gazetted 16 December 2022; VATP licensing regime commenced 1 June 2023; SFC circular 31 May 2023; Guidelines 1 June 2023	Operative	Creates licensed VATP nodes with AML, customer, custody and conduct obligations; continuity across external transitions still depends on interface arrangements.
Hong Kong	SFC circular on custody of virtual assets (Securities and Futures Commission of Hong Kong (SFC) 2025b)	SFC	15 August 2025; effective on issue	Operative	Strengthens custody controls and transaction-management expectations at licensed VATPs.
Hong Kong	SFC circular on shared liquidity by VATPs (Securities and Futures Commission of Hong Kong (SFC) 2025a)	SFC	Issued 3 November 2025; operation of a Shared Order Book requires prior written SFC approval	Operative supervisory framework; implementation is approval-dependent	Makes cross-platform order-book integration a governed interface with record, surveillance and risk-control implications.
Hong Kong	SFC circular for licensed corporations providing VA dealing services through omnibus/shared-order-book arrangements (Securities and Futures Commission of Hong Kong (SFC) 2026a)	SFC	Issued 11 February 2026; no separate commencement date stated	Operative supervisory framework	Extends safeguards to licensed-corporation dealing interfaces, including shared-order-book access and client-asset protection.
Hong Kong	Proposed VA dealer and standalone custodian licensing regimes (Securities and Futures Commission of Hong Kong (SFC) 2025c)	FSTB/SFC	Consultation conclusions: 24 December 2025; no commencement date	Legislative proposal; not operative	Relevant prospectively, but cannot be coded as an implemented guardian at the cut-off.
Hong Kong	Proposed VA advisory and management licensing regimes (Securities and Futures Commission of Hong Kong (SFC) 2026b)	FSTB/SFC	Consultation conclusions: 26 May 2026; bill targeted for 2026; no commencement date	Legislative proposal; not operative	Prospective perimeter expansion only; no implementation effect is attributed at the cut-off.
South Korea	Act on Reporting and Using Specified Financial Transaction Information, Act No. 21358: VASP registration amendments (Republic of Korea 2026a)	Republic of Korea; FSC/KoFIU implementation	Promulgated 19 February 2026; relevant registration provisions effective 20 August 2026	Operative in relevant part	Strengthens VASP entry and registration architecture, but does not make the later transfer-rule amendments operative.
South Korea	Enforcement Decree, Presidential Decree No. 36592, including amended Arts. 10-10 and 10-20 (Republic of Korea 2026b; Financial Services Commission of the Republic of Korea (FSC) 2026)	President/FSC-KoFIU	Promulgated 18 August 2026; general commencement 20 August 2026; amended Arts. 10-10 and 10-20 effective 19 February 2027	Split status: registration-related rules operative; expanded transfer rules not yet operative	Travel Rule threshold removal and new overseas-VASP/personal-wallet duties are enacted but prospective at the cut-off.
South Korea	Special Act on the Prevention of Loss Caused by Telecommunications-Based Financial Fraud and Refund for Loss, Act No. 21503: virtual-asset victim-asset provisions (Republic of Korea 2026c)	Republic of Korea	Promulgated 31 March 2026; relevant virtual-asset provisions effective 1 October 2026	Enacted; not yet operative	One day beyond the cut-off; relevant to prospective victim recovery, but not treated as implementation evidence.

5. Comparative Findings: Seven Recurrent Handoff Zones

5.1. Victim Report or Platform Warning to Financial and Cryptoasset Intervention

The first zone concerns the conversion of a victim report or platform warning into an actionable financial event. The upstream signal may contain narrative detail but lack transaction identifiers; conversely, a VASP may see a wallet transfer without knowing that it is connected to a coercive or deceptive interaction. The handoff succeeds when the receiving guardian can reliably link the report to an asset, account or transaction and determine what lawful preservation or review step is available.

Hong Kong’s ADCC and Anti-Deception Alliance demonstrate an institutional effort to shorten this transition by placing police and financial-sector partners into faster communication pathways. The 2025 Police Review reports real-time intelligence sharing and fund interception, while VATP-focused AML materials refer to a virtual-asset stop-payment mechanism (Hong Kong Police Force 2025a, 2026). In South Korea, the June 2026 police–VASP cooperation agreement similarly shows a pre-statutory attempt to connect investigative information to exchange controls (Korean National Police Agency 2026). These are law-in-action examples of handoff design, although the public materials do not disclose enough case-level data to estimate error rates or causal effects.

GHF in this zone is therefore not established by the existence of a report that failed to recover funds. It requires evidence that a downstream guardian existed and could have acted had the report retained or acquired the necessary identifiers, authority or timing. In this analysis, a victim’s inability to identify a wallet address or transaction hash is not treated as a deficiency; the relevant comparative question is whether banks, platforms or investigators can reconstruct those identifiers from accessible records.

5.2. Market Surveillance to AML Monitoring and Withdrawal Control

A second zone arises where market-conduct monitoring detects manipulation or anomalous trading but the relevant prevention opportunity appears at withdrawal or transfer. Market surveillance may observe wash trading, coordinated accounts or price manipulation, while AML functions assess customer and transaction risk. The two functions may sit within one firm but operate under different teams, rules and evidential vocabularies.

Hong Kong’s 2025 shared-liquidity circular is particularly instructive because it recognises that integrating an SFC-licensed platform with an affiliated overseas order book increases operational complexity for market surveillance and requires coordinated safeguards (Securities and Futures Commission of Hong Kong (SFC) 2025a). The observation is not that shared liquidity causes GHF, but that visibility becomes distributed across venues. South Korea’s market-conduct duties under the Virtual Asset User Protection Act coexist with AML duties under a different statute and supervisory lineage. The comparative implication is that a suspicious trading signal does not automatically become an AML or withdrawal-control signal merely because both functions are regulated.

The comparative materials permit a narrower analytical inference: continuity is visible in the documentary record where internal arrangements preserve a traceable event identifier, the basis of the market alert, the relevant accounts and temporal window, and an auditable escalation path to withdrawal review without converting suspicion into a conclusion of criminality. Where those elements are preserved, institutional differentiation does not by itself amount to GHF; where they are lost or cannot be reconstructed within the relevant time window, the interface becomes a candidate handoff failure. These are documentary indicators used to distinguish continuity from discontinuity in the present analysis, not evidence that any particular institutional design produces superior outcomes or warrants mandatory adoption.

5.3. Regulated Platform to Self-Hosted Wallet

The move from a regulated platform to a self-hosted wallet is a recurrent attribution transition. The platform knows its customer and can record the outgoing transaction, but it may not know who controls the destination wallet. A customer assertion, device evidence or analytic cluster can support an inference, yet those sources have different evidential quality. The key handoff question is whether provenance follows the transfer without converting uncertain attribution into an unqualified label.

Hong Kong’s existing VATP controls and custody guidance apply at the licensed node, while the proposed standalone custody and dealer regimes were not yet operative at the cut-off. South Korea’s existing Travel Rule remained subject to the pre-reform threshold at the cut-off; the 2026 decree had enacted but not yet commenced broader information duties and risk-based measures for overseas VASP and personal-wallet transactions (Republic of Korea 2026b). The reform therefore supplies a prospective natural experiment, not current implementation evidence.

A self-hosted wallet alone does not satisfy the coding rule for GHF. If no downstream intermediary exists, guardianship may simply be absent until the value reaches another controllable node. GHF arises when a later guardian receives the value but cannot make lawful use of upstream identity or transaction context that was available at the regulated exit.

5.4. Wallet or Bridge to Decentralised Services

Cross-chain bridges and decentralised services can change chain, asset form and technical context. Public ledgers may preserve transaction traces while cross-chain attribution becomes more difficult, and control may be divided among front-end operators, validators, administrators or upgrade-key holders. FATF’s functional approach is useful because it asks what a person actually does rather than relying on the label ‘DeFi’ (Financial Action Task Force (FATF) 2021).

The analytical boundary is important. Where no identifiable actor has meaningful custody or control, the absence of a guardian is not itself GHF. The transition becomes a GHF candidate when provenance that was available upstream is lost before the value reaches a later identifiable VASP, custodian, stablecoin issuer or fiat gateway. Technical provenance and legal responsibility are therefore distinct: a blockchain path can remain observable while no person is yet legally positioned to intervene.

Neither Hong Kong nor South Korea has eliminated this interface by domestic regulation. Both remain dependent on later controllable gateways and international cooperation. The comparison therefore illustrates why regulatory perimeter expansion and handoff continuity are separate questions.

5.5. Gaming and NFT Systems to Externally Transferable Value

Gaming systems and NFTs can create asymmetry between behavioural information and financial information. A game operator may observe account creation, device identifiers, play patterns, item provenance and linked accounts that are invisible to a VASP. A VASP may observe conversion or cash-out while lacking the context needed to evaluate an anomalous item transfer. The interface becomes criminologically relevant when an asset is externally transferable and convertible rather than merely an internal game unit.

South Korea makes the institutional separation especially visible because game-industry regulation and VASP/AML regulation are governed by different legal frameworks. That separation is not itself a failure. GHF would require a qualifying event in which legally shareable, risk-relevant game or account context is necessary for a downstream guardian and is not preserved or transmitted in time. Hong Kong’s broader virtual-asset framework is less tied to a distinct game regulator but faces the same functional problem where tokenised assets move between entertainment and financial environments.

Subjective pricing cannot itself establish laundering. The comparison therefore distinguishes observable indicators—common device control, repeated self-dealing patterns, item provenance and immediate cash-out—from analytical inferences about laundering. This distinction limits the risk that one institution’s weak inference is carried forward as another institution’s ‘fact’.

5.6. Offshore Service to Domestic Gateway

Cross-border transitions can combine all four discontinuities. A foreign provider may hold customer records; a domestic VASP may receive the asset; investigators may require preservation before mutual legal assistance produces admissible evidence; and a foreign restraint request may require recognition or domestic validation. These are legally distinct acts, and the analysis treats them separately rather than as a generic ‘transfer of authority’.

The framework therefore distinguishes information transfer, referral of responsibility, transmission of a request, recognition of a foreign measure, and activation of domestic power. A platform may voluntarily preserve records without recognising a foreign confiscation order. A domestic authority may be able to seek temporary restraint even though final confiscation requires judicial adjudication. A receiving jurisdiction may authenticate and preserve an event while reserving all merits questions.

Hong Kong’s FRONTIER+ cooperation and broader public-private financial-intelligence arrangements illustrate operational cross-border channels, while South Korea’s policing cooperation with VASPs and KoFIU’s referral practice illustrate domestic gateways that can support later international steps (Hong Kong Police Force 2025b; Korean National Police Agency 2026; Financial Services Commission of the Republic of Korea (FSC) 2022). The public evidence establishes mechanisms, not their success rate in cryptoasset recovery.

5.7. Private Detection to Public Coercion

The seventh zone is the boundary between private preventive capacity and public coercive authority. Private actors can conduct customer due diligence, monitor transactions, preserve records, impose contractually or statutorily authorised internal controls, and report suspicion. Compulsory production beyond ordinary compliance obligations, long-term restraint, adjudication of criminal liability, confiscation and final disposition of property remain public or judicial functions subject to jurisdiction-specific law.

This distinction prevents the intervention category from becoming conceptually overbroad. The analysis therefore disaggregates the sequence into at least five acts: preservation of records; temporary restriction of movement where law or contract permits; continued legal restraint by a competent public authority; adjudication of rights or confiscability; and return or restitution to victims. Each act has a different actor, legal threshold and evidentiary basis. Evidence preservation is therefore not asset recovery, and a temporary hold is not a finding of guilt.

In the comparative framework, this handoff is treated as successful when enough structured information reaches a public authority for legal validation without requiring the provider to conduct a full criminal investigation. A minimum event record can identify the event, asset, transaction, relevant accounts or addresses, source of the signal, confidence, preservation status and validation contact. The public authority then decides whether statutory thresholds for further production, search, restraint or international assistance are met. Table 5 summarises the comparative evidence across the seven handoff zones.

Table 5. Comparative evidence across the seven handoff zones.

Zone	Hong Kong: Actors and Evidence	South Korea: Actors and Evidence	GHF Question
1. Victim/platform signal → intervention	ADCC, banks/securities partners, VATPs; real-time intelligence and stop-payment/anti-scam arrangements documented by HKPF (Hong Kong Police Force 2025a, 2026)	Police–VASP cooperation; banks/VASPs/police operate under separate mandates; 2026 victim-asset statute not yet operative at cut-off (Korean National Police Agency 2026; Republic of Korea 2026c)	Can an incomplete victim or platform signal become a usable transaction event before dissipation?
2. Market surveillance → AML/withdrawal	SFC-licensed VATPs; custody and shared-liquidity circulars govern monitoring and safeguards (Securities and Futures Commission of Hong Kong (SFC) 2025a, 2025b)	VASPs under AML and user-protection regimes; FIU/FSC and market-conduct functions remain institutionally distinct (Republic of Korea 2001, 2023)	Does a market anomaly retain provenance and reach the actor able to review withdrawal/transfer?
3. Regulated platform → self-hosted wallet	Licensed-node rules apply; broader standalone custody/dealer regimes still proposed (Securities and Futures Commission of Hong Kong (SFC) 2023a, 2023b, 2025c)	Existing Travel Rule framework remained subject to pre-reform threshold; 2026 all-size/overseas-wallet amendments not yet in force (Republic of Korea 2026b; Financial Services Commission of the Republic of Korea (FSC) 2026)	Does identity/provenance remain usable when value leaves a regulated customer account?
4. Bridge/DeFi transition	Domestic perimeter cannot eliminate non-custodial or overseas technical interfaces	Same structural limitation; later regulated gateway may restore controllability	Is this absence of a guardian, or was upstream provenance lost before a later guardian appeared?
5. Gaming/NFT → external value	Financial and platform information may be distributed across distinct service providers	Game-industry regulation and AML/VASP regulation are institutionally separate (Republic of Korea 2006, 2001)	Can behavioural/item provenance be transmitted lawfully without treating subjective pricing as proof of laundering?
6. Offshore → domestic gateway	FRONTIER+, VAIT and licensed VASP interfaces document cross-border/public-private channels (Hong Kong Police Force 2025b, 2025c)	KoFIU referral practice and police–VASP cooperation provide domestic gateway mechanisms (Financial Services Commission of the Republic of Korea (FSC) 2022; Korean National Police Agency 2026)	Can a request be authenticated, recognised and converted into domestic preservation or restraint in time?
7. Private detection → public coercion	VATPs and financial institutions can monitor/report; coercive restraint remains a public/legal function	VASPs can monitor/report/contractually control within law; continued coercive restraint requires competent authority	Are preservation, temporary restriction, public restraint, adjudication/confiscation and return kept legally distinct?

6. Discussion

6.1. What the Comparison Establishes—And What It Does Not

The comparison supports a modest conclusion: both jurisdictions contain multiple specialised guardians, and the documentary record identifies recurrent interfaces at which prevention depends on more than the competence of a single node. It also shows that some operative initiatives explicitly address interface problems—for example, Hong Kong’s real-time anti-deception collaboration and shared-liquidity safeguards, and South Korea’s police–VASP cooperation. The study does not establish that these mechanisms reduce losses, nor does it rank the jurisdictions.

The regulatory-density argument should therefore be framed as a proposition. ‘Regulatory density’ means the number and functional coverage of legally or institutionally distinct control nodes relevant to a transaction path, not the volume of rules. As coverage expands, perimeter gaps may narrow while coordination dependence may rise if responsibilities, data and legal thresholds remain distributed. This relationship is conditional: density need not create vulnerability where interfaces are interoperable, and a lightly regulated system may remain more vulnerable because guardians are absent altogether.

The Hong Kong and South Korean materials illustrate conditions consistent with the proposition. Hong Kong has an operative VATP core and increasingly detailed supervisory arrangements while additional dealer, custody, advisory and management regimes were still proposed at the cut-off. South Korea has dense domestic VASP and user-protection regulation while key transfer-related AML reforms have been enacted but not yet commenced. In both settings, adding or strengthening nodes raises the importance of specifying how information and lawful action cross boundaries, but only future performance data can test whether coordination dependence actually increases.

6.2. A Victim-Centred Handoff Architecture

Victim protection is therefore internal to the GHF framework rather than an external policy add-on. If handoff discontinuity can prolong exposure, enable additional losses, obstruct time-sensitive preservation and multiply the procedural burdens placed on victims, continuity is accordingly evaluated partly from the victim-facing side of the system. A handoff is not analytically complete merely because information reaches another institution; the relevant question is also whether the transition preserves a usable pathway through which a victim’s report can be translated into verification, preservation, communication and, where legally available, recovery. Victim-facing protection thus supplies one criterion for evaluating whether guardianship remains continuous; it is not merely a desirable policy outcome added after the theoretical analysis. The design principles below follow from that theoretical premise, while remaining normative recommendations rather than demonstrated causal effects.

Victim-centredness must have operational content. First, reporting pathways should accept incomplete information. Victims should not be required to know a wallet address or transaction hash where a bank, exchange, platform or investigator can reconstruct it from account and time information. Second, intake should accommodate language and digital-literacy barriers and avoid repeated requests to retell the entire event when a verified narrative can be reused across authorised institutions. Third, victims should receive realistic status communication about what has been preserved, what remains uncertain and what recovery procedures are available.

Fourth, the architecture must distinguish urgent assistance from unverified allegation. Malicious or mistaken complaints create risks of wrongful restriction, so a complaint should trigger structured verification rather than automatic long-term freezing. Fifth, recovery communications should warn victims about secondary ‘recovery scams’ that exploit people already seeking restitution. Sixth, access should not depend solely on the amount lost. Triage can be risk-based, but low-value victims may reveal linked cases, repeat offenders or aggregate harms and should retain a meaningful reporting and status pathway.

The proposed design has six components. A risk-triggered escalation rule defines when a handoff begins. A minimum event record preserves identifiers, provenance and confidence. Preservation-ready evidence secures native records and audit trails. Authenticated channels support domestic and cross-border requests. Legally bounded temporary measures preserve the status quo where authorised, while public validation governs continuation. Reciprocal feedback allows reporting institutions to learn which indicators were useful or erroneous.

These components are recommendations rather than empirically demonstrated effects. Some are directly responsive to weaknesses visible in the comparison, such as delayed commencement, split mandates and distributed information. Others—data minimisation, correction, accessible victim communication and proportionality—are broader normative principles derived from criminological and legal reasoning.

6.3. Evaluation Strategy and Confounding

The four propositions can be tested only with designs that address important confounders. Detection and recovery outcomes are affected by reporting delay, offender sophistication, asset type, amount, market volatility, staffing, technical resources, custodian cooperation, quality of victim-provided information, international response time and simultaneous reforms. Before-and-after designs that ignore these factors could wrongly attribute changes to a handoff intervention.

South Korea’s delayed 2026 AML transfer provisions may provide an evaluation opportunity after they actually commence. A valid design should use the legal commencement of the relevant decree provisions rather than the August 2026 cabinet approval as the intervention date. Hong Kong’s future dealer or custody licensing regimes should likewise be evaluated from actual commencement, not consultation or bill introduction. Where phased implementation occurs, event-study or difference-in-differences approaches would need a defensible comparison group and sensitivity tests for concurrent enforcement campaigns.

Relevant outcomes include time from first reliable signal to triage; time to record preservation; time to temporary restriction and public validation; additional victim transfers after the first signal; completeness of attribution; rate of corrected false positives; proportion of cases reaching lawful restraint; amount preserved; amount returned to victims; and wrongful restriction or release rates. These outcomes separate administrative activity from victim-centred performance. Table 6 links the propositions to candidate predictors, outcomes and confounders for future empirical testing.

Table 6. Propositions and a future evaluation strategy.

Proposition	Predictor/Contrast	Candidate Outcomes	Key Confounders/Controls
P1 Handoff concentration	Number of functionally meaningful transitions	Triage delay; preservation delay; additional transfers/loss	Reporting delay, route complexity, asset type, amount, offender sophistication
P2 Split capability	Separation between strongest observer and strongest lawful intervener	Escalation time; proportion of signals reaching actionable review	Staffing, working hours, technical resources, legal threshold, case severity
P3 Interface visibility	Structured event record/provenance/interoperable identifier vs ordinary referral	Attribution completeness; request rework; time to validation	Data quality, vendor analytics, custodian cooperation, victim information
P4 Reversible intervention	Lawfully bounded temporary preservation/restriction vs no such mechanism	Value preserved; wrongful restriction/correction; time to public validation	Simultaneous reforms, reporting mix, liquidity/volatility, institutional capacity

7. Rights, Legality and the Limits of Private Guardianship

7.1. Purpose Limitation, Proportionality and Correction

Stronger handoff capability can become harmful if it is equated with unrestricted data pooling or private adjudication. Interoperability must have a legal purpose, defined providing and receiving bodies, limited data categories, retention periods, access controls and correction mechanisms. The objective is continuity of a case, not a permanent centralised data lake containing platform content, banking data, device identifiers and wallet histories.

Provenance is also a due-process safeguard. A receiving institution should be able to distinguish a directly observed transaction from a customer assertion, a vendor label, a heuristic cluster and an inference of common control. If an address is wrongly labelled at one node, downstream institutions should not inherit the error without a means of correction. Commercial analytics can assist investigation, but they do not transfer legal responsibility for a restrictive decision.

Temporary interruption, where legally authorised, should be time-limited, reversible and reviewable. A high-confidence risk event may justify preservation while a competent authority validates further action, but a score alone should not justify long-term deprivation. The customer’s opportunity to challenge a consequential restriction should be preserved to the extent compatible with legitimate investigative secrecy.

System-level proportionality also matters. High compliance costs can drive activity to opaque offshore venues or entrench dominant intermediaries. Function- and risk-based standards may therefore be preferable to uniform infrastructure requirements, provided that equivalent risks remain subject to comparable minimum handoff capability.

7.2. Separation of Preservation, Restraint, Confiscation and Return

The legal sequence should remain explicit. Record preservation protects evidence. A provider-level temporary restriction preserves the status quo only where a lawful basis exists. Continued restraint ordinarily requires the competent public or judicial process. Confiscation or determination of ownership requires adjudication under the applicable legal regime. Return to a victim is a further step that may depend on tracing, priority rules and a statutory restitution mechanism.

This separation is particularly important for cross-border cases. A request to preserve records or delay movement should not be described as ‘transferring authority’ if the receiving state must independently activate domestic powers. Likewise, recognition of a foreign restraint or confiscation measure is a legal act distinct from transmitting the request. More precise verbs—transmit, refer, authenticate, recognise, activate and preserve—make the handoff concept legally tractable.

8. Limitations

The study has several limitations. First, it relies on public documents and therefore has incomplete visibility into operational protocols, proprietary monitoring systems, informal contacts and confidential case practices. The analysis can identify published mechanisms and gaps in public architecture but cannot infer that an unpublished handoff does not exist.

Second, the corpus includes materials in English and Korean. Korean legal texts were checked in the original language, but translation choices can still affect the description of concepts that do not map perfectly onto English regulatory terminology. Third, the field changed rapidly during the study. The explicit 30 September 2026 cut-off reduces status ambiguity but also means that reforms commencing after that date are necessarily treated prospectively.

Fourth, the two-jurisdiction design supports theory building rather than generalisation to all regulatory systems. Hong Kong and South Korea are both relatively sophisticated markets and do not represent low-capacity or lightly regulated environments. Fifth, the study contains no transaction-level, victim-outcome or internal performance data. It therefore cannot estimate the causal effect of a handoff arrangement on prevention or recovery.

Finally, theory-building from selected transition zones creates a risk of confirmation: examples that fit the framework may be easier to notice. The coding rule, negative condition and explicit non-GHF categories are intended to reduce this risk, but future empirical work should deliberately sample ordinary successful handoffs, lawful non-intervention, false positives and cases where no guardian exists, as well as failures.

9. Conclusions

Cryptoasset-enabled cybercrime creates prevention problems not only because deception is scalable or assets move across borders, but because the meaning and controllability of an event can change each time it crosses an institutional boundary. A system may contain capable guardians and still fail if a receiving guardian cannot inherit or reconstruct what is needed before the opportunity changes.

GHF identifies that transition-level vulnerability. It is not a synonym for fragmentation and does not treat every missing power or every delay as a handoff failure. A qualifying GHF event requires a relevant transition, an existing or lawfully activatable downstream guardian, a capability needed from upstream, and a failure to preserve, transmit, recognise, reconstruct or activate that capability within the relevant time window. Observability, attribution, authority and intervention are non-exclusive diagnostic dimensions rather than self-proving outcomes.

The Hong Kong–South Korea comparison illustrates the usefulness of the construct while also showing the need for legal-status discipline. Hong Kong’s VATP regime and several supervisory initiatives were operative at the cut-off, whereas broader dealer, custody, advisory and management regimes remained proposed. South Korea’s August 2026 decree strengthened the future architecture for cryptoasset transfers, but its key Travel Rule and overseas-VASP/personal-wallet provisions had not yet commenced by 30 September 2026. Operational police, FIU and public–private initiatives in both jurisdictions nevertheless show that handoff governance already exists in practice.

The study therefore supports a research agenda rather than a causal verdict. Future work should test whether specific handoff characteristics affect delay, additional victimisation, evidential usability, wrongful restriction, preservation and return of assets. The normative implication is more limited: prevention architecture should make transitions visible, preserve provenance, keep private and public powers distinct, permit proportionate and reviewable action where authorised, and treat accessible victim reporting and recovery as core system functions. GHF is valuable if it helps researchers and institutions ask not only whether a guardian exists, but whether guardianship remains usable when responsibility, information and control must move.