For a digital-asset business weighing two of the world's most consequential licensing destinations, the choice between Hong Kong and the United Kingdom is not a matter of prestige. It turns on regulatory posture, licence category, your user base, and whether your banking and custody layers can survive the scrutiny that follows authorisation. Operating without the right structure in either jurisdiction exposes the business to enforcement action, frozen payment rails, and the kind of banking termination that can take months to reverse.
Hong Kong's Securities and Futures Commission (SFC) operates a mandatory virtual-asset trading platform (VATP) licensing regime for centralised exchanges serving retail. The United Kingdom's Financial Conduct Authority (FCA) requires cryptoasset registration under the Money Laundering Regulations (MLR) for any business operating in the crypto space from, or into, the UK – and separately imposes financial-promotion rules for crypto marketing. These are structurally different obligations, and confusing them is the first mistake boards make. This analysis maps both regimes across the decisions that matter: regulator posture, licence type, timeline, substance requirements, AML obligations, and the cross-border reality of banking and tax.
Regulator Posture: How Each Authority Approaches the Market
The SFC and the FCA have arrived at crypto regulation from different institutional starting points, and the difference shapes everything downstream. The SFC administers a regime that treats a virtual-asset trading platform as a regulated venue in the same conceptual space as a licensed securities exchange – rigorous vetting, mandatory insurance, and close post-authorisation supervision. The FCA began with an AML-first registration regime, reflecting the UK's original FATF-driven approach, and has since layered financial-promotion rules on top. The two regimes are not equivalent in ambition or burden.
Hong Kong has made a deliberate policy choice to position itself as an institutional-grade digital-asset hub. The SFC expects applicants to demonstrate real substance: a management team with relevant experience, a technology architecture that meets its standards, and a viable business plan with adequate capitalisation. The FCA's MLR registration, by contrast, was designed to filter out high-risk AML actors, not to validate business models. That distinction matters when you are planning your regulatory strategy.
In our licensing practice, operators who treat UK MLR registration as a lighter-touch alternative to the SFC regime are frequently surprised by how demanding the FCA's fit-and-proper assessment has become in practice. Refusal rates under the FCA's crypto registration process have been reported as notably high. The FCA has also signalled that a broader authorisation regime for crypto firms is forthcoming, which will raise the bar further.
What Licences Are Actually Required?
The licence you need in each jurisdiction depends entirely on what your business does – and this is where the two regimes diverge most sharply. Neither framework is a single catch-all authorisation. Both require a careful mapping of activities to regulated categories before you file.
Under the SFC's VATP regime, a centralised exchange offering trading in virtual assets – including those that are not securities – to Hong Kong retail clients requires a VATP licence. Virtual assets that constitute securities trigger additional obligations under the Securities and Futures Ordinance. Custodians holding client assets in Hong Kong face custody requirements embedded within the VATP framework and, depending on structure, potentially separate regulated activity permissions. Fund managers investing in virtual assets above defined thresholds are already within the SFC's existing fund-management licensing regime.
In the United Kingdom, the activity map looks different. MLR registration is the baseline obligation for any cryptoasset business carrying on relevant activities in the UK. Beyond that, a firm issuing tokens that qualify as specified investments under the financial-services regime needs full FCA authorisation – not merely registration. The financial-promotion rules, which came into force for crypto in 2023, add a further compliance layer: communicating a financial promotion about a qualifying cryptoasset requires either FCA authorisation or approval by an authorised person. These layers do not replace each other. A business can need all three simultaneously.
How Does the Application Process Compare?
The application process in Hong Kong is substantively heavier than MLR registration in the UK, but the two tracks have converged more than many applicants expect. Both require detailed AML/CFT frameworks, governance documentation, and management vetting. The SFC process goes further in scrutinising technology, product design, and client-money handling.
The SFC's VATP licensing process is multi-stage. An applicant submits a detailed application covering corporate structure, ownership, management, technology systems, AML programme, and business plan. The SFC conducts active dialogue with applicants, raises queries, and may require third-party technology audits. The process is measured in months rather than weeks, and applicants who underestimate the documentation burden frequently extend their timelines materially.
The FCA's MLR registration involves submission of a detailed online application covering beneficial ownership, management, AML/CFT policies and procedures, and business model description. The FCA has extended its standard assessment windows in recent years as volumes have increased. Firms operating in a temporary registered status while awaiting determination must continue to comply fully with the MLR obligations. Applicants who approach the FCA registration as an administrative formality – rather than as a substantive regulatory assessment – face the highest rate of withdrawal or refusal.
In both jurisdictions, preparation is the variable that most reliably determines timeline. We regularly advise clients that the internal readiness work – governance documentation, AML framework drafting, technology assessment, management vetting preparation – takes longer than the regulator's own review period. Building that time into the project plan is not optional.
To map your application timeline and substance requirements before you commit resources, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity's existing structure, the target user base, the banking arrangements – change the analysis materially.
AML, Travel Rule and Financial Crime Obligations
Both Hong Kong and the United Kingdom have implemented the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer), aligned to FATF Recommendation 15. Compliance with the Travel Rule is a live operational requirement in each jurisdiction, not a future obligation.
Under the SFC regime, VATPs are expected to have implemented Travel Rule compliance as part of their technology and operational stack at the point of licensing. The SFC's AML guidance for virtual-asset service providers is detailed and prescriptive, covering customer due diligence, transaction monitoring, and reporting obligations. A VATP that cannot demonstrate a functional Travel Rule implementation will not receive a licence.
In the United Kingdom, the FCA and HMRC both play roles in crypto AML supervision. The FCA is the AML supervisor for registered cryptoasset businesses. Travel Rule obligations apply to UK-registered firms, and the FCA has made clear that operational readiness for the Travel Rule is a condition of continued registration. The threshold for Travel Rule data transmission in the UK follows the general FATF-aligned approach, though the precise de-minimis figure should be confirmed against current FCA guidance at the time of application.
Cross-border transfers raise an additional layer of complexity. A Hong Kong-licensed VATP transferring to a UK-registered counterpart – or vice versa – must apply both regimes to the same transaction. Operators we advise routinely discover that their counterparty network includes firms that have not yet implemented compliant Travel Rule solutions, which creates both compliance gaps and commercial friction.
Substance, Banking and Tax: The Layers Around the Licence
A licence is the admission ticket, not the product. The commercial viability of a Hong Kong or UK structure depends on whether the business can also obtain banking, operate with genuine local substance, and manage its tax position across jurisdictions.
Hong Kong has historically offered good access to banking for regulated digital-asset businesses, though the environment has tightened. Licensed or licence-pending VATPs with demonstrable SFC engagement have an advantage in bank onboarding discussions. That said, correspondent banking restrictions and group-level risk appetite at global banks mean that the banking picture is never straightforward. Building the banking relationship in parallel with the licence application – rather than after it – is the approach we consistently recommend.
In the United Kingdom, banking access for crypto businesses remains one of the most frequently cited operational challenges. FCA registration does not guarantee banking. UK-incorporated crypto firms, including those with full MLR registration, have faced account closures and refusals from major UK clearing banks. The practical banking stack for a UK-registered crypto business frequently involves a combination of UK-based challenger banks, EU-passported EMIs, and offshore accounts – each of which introduces its own compliance footprint.
On tax, Hong Kong's territorial corporate tax system is generally favourable for businesses whose income is generated outside Hong Kong. Profits arising in Hong Kong are taxed, but the absence of VAT or a capital-gains tax regime makes Hong Kong structurally efficient for many digital-asset business models. The UK applies corporation tax on worldwide profits of UK-resident companies, and HMRC's guidance on the tax treatment of cryptoassets – covering exchange tokens, utility tokens, and securities tokens differently – is detailed and must be mapped against the specific business model before incorporation.
A recurring cross-border issue is the interaction between where the entity is incorporated, where the management and control sits, and where the customers are located. A Hong Kong VATP licensing entity whose key management effectively operates from the UK may face questions about UK tax residence. Getting that question right before structure commitment is considerably cheaper than correcting it afterwards.
If your licensing strategy intersects with a banking or tax question that has already stalled your project, write to info@oboluslaw.com – a second read frequently surfaces the structural reason and the route forward.
Decision Matrix: Which Profile Fits Which Jurisdiction?
No single jurisdiction is the right answer for all operators. The question is which regime aligns with your business model, your user base, and your operational capacity. What follows is a profile-based mapping. It does not produce a single verdict – it maps the most common operator profiles to the most likely strategic fit.
Retail-facing centralised exchange targeting Asian markets. The SFC's VATP regime is the operative track. A Hong Kong licence provides direct access to the Hong Kong retail market and credibility with institutional counterparts across the region. The application burden is high. The substance expectation is real. The business must be prepared to operate as a genuinely regulated entity from day one, not to treat the licence as a compliance badge. Timeline is measured in months; pre-application preparation extends that further.
Institutional crypto brokerage or OTC desk targeting UK/EU counterparts. FCA registration is necessary for UK-facing activity. If the firm is marketing to UK persons, the financial-promotion rules apply immediately, regardless of where the entity is incorporated. For a business that is genuinely institutional and not offering retail services, the MLR registration burden is lower relative to the SFC track, but the post-registration compliance expectations – particularly on AML – are substantial. Consider whether a UK-registered entity or a MiCA-authorised CASP passporting into the UK (post-recognition) better serves the long-term distribution strategy.
Crypto custodian holding assets for institutional clients. Both Hong Kong and the UK have regulatory expectations around custody. In Hong Kong, custody of client assets for a licensed VATP is regulated within the VATP framework; standalone custody businesses should take specific advice on whether a separate regulatory permission is required. In the UK, safeguarding client cryptoassets as a regulated activity is an evolving question as the broader authorisation regime develops. A custodian planning to operate across both jurisdictions should plan for the possibility that each jurisdiction triggers a separate regulatory requirement.
Token issuer seeking a compliant issuance venue. Neither Hong Kong nor the UK is primarily an issuance jurisdiction in the way that some offshore centres have historically been used. In Hong Kong, token sales involving securities-like tokens fall within the SFC's remit. In the UK, the FCA's financial-promotion rules and the broader authorisation regime for issuance-related activities apply. An issuer planning a public sale should take advice on both the characterisation of the token and the applicable promotion rules before selecting a venue.
Crypto fund or fund manager. In Hong Kong, the SFC's existing fund-management licensing regime captures managers of funds with meaningful crypto exposure. In the UK, a fund manager authorised by the FCA to manage collective investment schemes may engage with crypto assets subject to internal risk frameworks and FCA expectations. The structuring question – onshore versus offshore fund vehicle, manager location, investor jurisdiction – requires a full stack analysis before the licensing question can be answered.
The Cross-Border Reality: Why One Licence Is Rarely Enough
A common assumption among operators entering either the Hong Kong or UK market is that a single licence in the chosen jurisdiction resolves the regulatory position for their entire global operation. It does not. Both the SFC and the FCA apply jurisdiction-of-effect principles: if your platform is accessible to Hong Kong or UK residents, the relevant regime applies regardless of where your entity is incorporated.
This means that an exchange incorporated in a third jurisdiction – say, a BVI holding structure with operational entities elsewhere – cannot simply geo-block Hong Kong or UK users and consider the position resolved. The quality of the geo-blocking, the KYC at onboarding, and the terms of service must actually function to exclude the relevant user population, and regulators in both jurisdictions have examined platforms that claimed jurisdictional exclusion without operational substance behind it.
In our cross-border practice, the most common structural error we encounter is the assumption that an entity licensed in one jurisdiction can passport its way into another without local authorisation. MiCA passporting applies within the EU/EEA. The SFC and FCA have no mutual recognition arrangement that allows a licence in one to substitute for a requirement in the other. A business serving both markets needs both regulatory relationships – managed either through separate licensed entities or through an explicit regulatory analysis of which activities are being performed where.
Allied counsel in the relevant jurisdictions are essential where the structure spans multiple licensing regimes simultaneously. We coordinate those relationships as part of the engagement.
A Note from Practice
In a recent cross-border licensing matter, an institutional exchange operator with entities in both the Asia-Pacific region and Europe engaged us to assess why its banking relationships were deteriorating despite holding registrations in multiple jurisdictions. The analysis surfaced a structural mismatch: the entity holding the most prominent licence was not the entity conducting the regulated activities – a discrepancy that both the banking compliance teams and the relevant regulator had identified. We restructured the activity-to-entity mapping, coordinated an updated disclosure to the relevant authority, and the banking relationships stabilised within a quarter. The lesson was not about the quality of any single licence. It was about whether the structure behind the licence matched the operational reality.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the full scope of our licensing practice across 70+ jurisdictions
- Crypto Exchange Licensing: Practical Lessons for Boards – board-level analysis of the most common licensing failures and how to avoid them
- Corporate Bank Account Opening Under Heightened Scrutiny – how to approach banking for a licensed crypto business when standard channels are closed
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction and licence type. The SFC's VATP licensing process in Hong Kong typically runs over many months, with pre-application preparation extending that further. FCA MLR registration in the UK has also extended in recent years as the regulator's scrutiny has increased. In both cases, the internal preparation work – AML framework, governance documentation, management vetting – is frequently the longer phase. Build a realistic runway before committing a launch date to investors or commercial partners.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your activity type, target user base, existing corporate structure, banking relationships, and management substance. A retail-facing exchange targeting Asian markets faces a different analysis than an institutional OTC desk serving European counterparts. Both Hong Kong and the UK are credible, well-regulated venues – but the fit depends on your specific facts. A pre-commitment jurisdictional analysis, mapping the licence, banking and tax layers together, is the most reliable way to answer the question for your situation.
Do I need a separate custody licence?
In Hong Kong, custody of client virtual assets is addressed within the VATP framework for licensed exchanges, but a standalone custodian should take specific advice on whether a separate regulated activity permission is required under the SFC regime. In the United Kingdom, the regulatory treatment of crypto custody is evolving as the broader authorisation regime develops. In either jurisdiction, assuming that a primary licence covers all custody activity without specific analysis is a common and correctable mistake. The answer depends on the structure, the client type, and the assets held.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so the structure you build is the one that holds. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in comparative licensing strategy for exchanges, custodians and token issuers across the Asia-Pacific and European regulatory environments.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.