For a digital-asset business deciding where to plant its regulatory flag, the choice between the British Virgin Islands and Hong Kong is rarely simple. Both jurisdictions are credible; both have active supervision; and both carry real operational consequences. The question is which profile fits your business model, your user base and your banking strategy – and which regime's costs you can bear if the answer changes.
The British Virgin Islands operates a registration-based VASP (virtual asset service provider) regime under the BVI Financial Services Commission, while Hong Kong operates a full licensing regime for virtual-asset trading platforms (VATPs) under the Securities and Futures Commission (SFC). The two are not substitutes: one is a lighter-touch compliance perimeter suited to specific fund and holding structures; the other is a substantive operating licence that opens access to institutional banking and sophisticated-investor markets across the Asia-Pacific region. The analysis below maps both regimes across the axes that matter most to operators.
The Regulatory Perimeter: What Each Regime Actually Covers
The BVI VASP Act 2022 requires registration – not licensing – for entities carrying on virtual asset service activities from or within the BVI. The BVI Financial Services Commission (BVI FSC) administers the register. The Act is modelled on FATF Recommendation 15 standards: it targets anti-money-laundering compliance, beneficial-ownership disclosure and the Travel Rule obligation to pass originator and beneficiary data with transfers. It does not impose a prudential capital regime comparable to the major financial centres.
Hong Kong's SFC VATP licensing regime sits at the other end of the spectrum. The SFC requires entities operating centralised virtual-asset exchanges to hold a VATP licence and imposes conduct requirements, client-asset safeguarding rules, cybersecurity standards and ongoing supervisory obligations. Only platforms that serve retail investors in Hong Kong – or that solicit business from Hong Kong users – are within scope, but the SFC's interpretation of "carrying on a business in Hong Kong" has been read broadly.
The boundary matters immediately for cross-border operations. A BVI-registered VASP serves as a holding or fund domicile in many structures we see. It does not, by itself, authorise the operator to conduct regulated activities toward retail users in jurisdictions with their own licensing requirements – including Hong Kong, the EU and Singapore. Operators who treat BVI registration as a global permission slip expose themselves to enforcement action in the markets they actually serve.
For a scoped review of which regime covers your specific activity, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis substantially.
Who Needs a Licence in Each Jurisdiction?
BVI registration applies to any entity incorporated in the BVI that conducts virtual asset service activities – broadly, exchange, transfer, custody, administration and participation in token offerings. The trigger is the entity's domicile and the nature of its activity, not solely the location of its customers. A BVI holding company that passively holds digital assets for a group entity generally falls outside the VASP Act's scope; a BVI entity actively conducting exchange or transfer services does not.
Hong Kong's VATP requirement is activity-driven and user-location-driven. An entity that operates a centralised trading platform and markets to, or accepts business from, persons in Hong Kong must hold an SFC VATP licence regardless of where the operator is incorporated. In our cross-border practice, we regularly advise clients who incorporated offshore specifically to avoid Hong Kong supervision – and who then found that their marketing or customer-service presence triggered the SFC's jurisdictional reach.
The practical implication: a BVI structure with a Hong Kong-facing business typically requires both BVI FSC registration and SFC licensing. Neither alone is sufficient. Operators must map the activity layer and the geography of their user base before selecting a single-jurisdiction structure.
What Does the Application Process Look Like in Practice?
BVI FSC registration is procedurally lighter than full licensing in the major financial centres. The application requires a completed registration form, AML/CFT policies, a business plan, beneficial-ownership information and evidence of fitness and propriety for key persons. Timelines are generally shorter than those of the SFC regime, though the BVI FSC has tightened its review process in recent years and applications that are incomplete or that present complex ownership structures take correspondingly longer.
The SFC VATP licensing process is substantive and extended. Applicants submit detailed documentation covering corporate governance, risk management, cybersecurity architecture, client-asset segregation arrangements, AML/CFT frameworks and the qualifications of responsible officers. The SFC operates a vetting process that includes in-person interviews and a period of regulatory dialogue that operators should plan for. Timelines vary by complexity and the quality of the initial submission; in our practice, we advise clients to treat the SFC process as a multi-phase engagement rather than a one-time filing.
A common mistake at the application stage is under-investing in the substance behind the documentation. The SFC, in particular, expects that the policies submitted reflect the operator's actual infrastructure. Submitting template AML policies without evidence that systems, staff and controls are in place is among the most frequent causes of application delay or rejection. The BVI FSC has similarly increased its scrutiny of applications where substance is thin.
AML, the Travel Rule and Compliance Posture
Both jurisdictions align to FATF Recommendation 15 and its Travel Rule requirement. The Travel Rule obligates VASPs to collect and transmit originator and beneficiary data when transferring virtual assets, above thresholds that vary by jurisdiction and are subject to ongoing regulatory update.
In the BVI, the Travel Rule obligation sits within the VASP Act's AML/CFT requirements, and the BVI FSC expects registered entities to have technical solutions in place to meet it. The absence of a large local financial-services ecosystem means that BVI-registered entities must typically procure Travel Rule compliance technology from third-party providers.
Hong Kong's approach is more layered. The SFC's licensing conditions for VATPs include detailed AML/CFT conduct requirements, and the SFC coordinates with the Hong Kong Monetary Authority on crypto-related payment flows. Entities operating in Hong Kong must integrate Travel Rule compliance into their onboarding and transaction-monitoring infrastructure – and demonstrate that integration during the licensing process, not after. We have seen applications stall because the Travel Rule solution was treated as a post-licensing task.
Tax and Banking Interaction: The Consequences That Determine the Structure
The BVI imposes no corporate income tax on offshore business activities. That structural fact makes BVI entities attractive as holding companies and fund vehicles in group structures where the taxable event occurs elsewhere. However, the absence of a tax treaty network and the reputational dynamics of using a well-known offshore centre increasingly create friction with banking counterparts, institutional investors and regulators in the operating jurisdictions.
Hong Kong offers a territorial tax regime with a relatively low corporate tax rate. Profits arising from transactions conducted outside Hong Kong may fall outside the Hong Kong tax net, depending on the facts and the application of source rules. Hong Kong maintains an extensive tax treaty network, which matters for group treasury arrangements and for operators seeking to upstream earnings from operating entities to holding structures.
Banking access is the axis on which the two jurisdictions diverge most sharply in practice. A BVI-registered VASP faces material challenges opening correspondent and operational bank accounts in major financial centres. The combination of offshore incorporation and digital-asset activity places these entities at the upper end of the risk spectrum for most banks. Operators regularly approach us after a banking relationship has been closed – a pattern we have seen accelerate as banks apply heightened scrutiny to offshore crypto structures.
An SFC-licensed VATP in Hong Kong, by contrast, operates within a regulatory perimeter that a growing number of banks treat as a credibility signal. The licence does not guarantee banking access, but it significantly narrows the compliance conversation. Several banks in Hong Kong have established dedicated crypto-banking desks, and the SFC-licensed status is a material factor in those conversations.
If prior applications stalled or banking relationships have closed, a second read of the structure can surface the cause and the route back. Contact OBOLUS at info@oboluslaw.com.
Decision Matrix by Operator Profile
Different operator profiles reach different conclusions from the same two regimes. The following analysis maps four common profiles.
The crypto exchange with retail ambitions in Asia-Pacific will almost always need SFC VATP licensing. BVI registration does not authorise retail-facing exchange activity toward Hong Kong users; it does not provide the banking credentials that institutional partners require; and it does not satisfy the licensing expectations of other APAC regulators that look to Hong Kong as a reference jurisdiction. The timeline and cost of the SFC process are the operative constraints, and the question is whether to structure the Hong Kong entity as the primary operating entity or as a regulated subsidiary of an offshore holding structure.
The digital-asset fund – a fund investing in tokens, DeFi positions or liquid digital assets – frequently uses a BVI structure for the fund vehicle itself, with the fund manager licensed in a jurisdiction that recognises the relevant management activities as regulated (Hong Kong, Singapore or elsewhere). The BVI VASP registration may be required for the fund if it conducts virtual asset service activities. The manager-level licensing question is separate and depends on the manager's domicile and the fund's investor base.
The token issuer faces a different analysis. A BVI entity issuing tokens may benefit from the offshore domicile for the issuer itself, but the regulatory treatment of the token in the markets where it is offered determines whether additional licensing is required. Under MiCA in the EU, under the SFC's tokenisation guidance in Hong Kong, and under Singapore's Payment Services Act, the issuer's BVI registration does not displace the host-jurisdiction requirement. We advise issuers to treat the token classification exercise as the threshold question before any jurisdiction is selected for the issuer entity.
The custodian – an entity holding digital assets for third parties – faces licensing requirements in both jurisdictions, but the depth of those requirements differs. BVI VASP registration covers custody as a virtual asset service activity. SFC licensing imposes custody-specific conduct requirements that go substantially further: client-asset segregation, insurance or equivalent arrangements and technical security standards. A custodian targeting institutional clients will generally find that the SFC licence carries more weight with counterparts than BVI registration alone.
A Common Assumption About Offshore Licensing – and Why It Fails
A widespread belief among early-stage operators is that a single offshore registration – BVI, Cayman, Seychelles – provides a compliant basis for serving clients globally. It does not. Every major market with a material retail or institutional investor base has its own licensing or registration requirement for entities that conduct virtual asset services toward its residents or from within its territory.
The BVI VASP Act applies to activities conducted from the BVI; it does not address whether the operator also needs a licence in the jurisdiction of its customers. The SFC's jurisdictional reach applies to platforms serving Hong Kong users regardless of where those platforms are incorporated. The EU's MiCA CASP authorisation applies to any entity offering crypto-asset services to clients in the EU, irrespective of whether the entity holds an offshore registration.
In our practice, we regularly identify operators carrying three or four jurisdictional exposures that their existing offshore registration does not address. The remediation path – retroactive licensing applications, restructuring and, in some cases, voluntary disclosure – is always more expensive than an upfront jurisdictional map. Operating without the right licence in any active market risks enforcement, frozen payment rails and the loss of banking relationships that took years to build.
We map the licence stack across operating, custody and payment layers before you commit to a structure. That analysis – conducted before incorporation, before banking applications and before marketing begins – is the most cost-effective legal work in the digital-asset lifecycle.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full practice overview, covering 70+ jurisdictions and every major licence category.
- Crypto Regulation and Licensing in Malta – how the MFSA's VFA-to-MiCA transition affects operators seeking EU access.
- Smart Contract Dispute Resolution – counsel for digital-asset firms when commercial disputes escalate to litigation or arbitration.
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and licence category. BVI VASP registration is generally shorter than a full VATP licence application to the SFC, which involves a multi-phase review including regulatory dialogue and in-person vetting. The quality of the initial submission is the single greatest determinant of timeline in both cases. Operators should plan for a process measured in months, not weeks, for any substantive licensing exercise.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on the activity being conducted, the location of users, the banking strategy, the operator's tax position and the regulatory expectations of institutional counterparts. BVI registration suits certain fund and holding structures; Hong Kong VATP licensing suits retail-facing exchanges targeting the Asia-Pacific market. Most operators with genuine business scale require a multi-jurisdictional licence stack, not a single offshore registration.
Do I need a separate custody licence?
In most flagship regimes, custody of digital assets for third parties constitutes a regulated activity requiring its own authorisation or an explicit extension of an existing licence. Under the SFC's VATP regime, custody requirements are embedded in the licensing conditions. Under the BVI VASP Act, custody is a covered virtual asset service activity. If your business combines trading and custody functions, confirm with counsel whether both activities are covered under a single authorisation or whether a separate regulatory permission is required.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the whole of our practice. Operators we advise regularly face the precise BVI-versus-Hong Kong decision described above: we map the licence, banking and tax stack before they commit. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in cross-border licence strategy for digital-asset businesses across the Asia-Pacific and offshore-centre regulatory environments.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.