Operating a crypto business without the right regulatory authorisation is not merely a compliance gap. It is an existential risk. Enforcement action, frozen payment rails and the abrupt closure of banking relationships have ended businesses that were otherwise well-run. Two jurisdictions that attract serious operators as a primary licensing domicile are Malta – operating through the Malta Financial Services Authority (MFSA) and its Virtual Financial Assets (VFA) framework, now transitioning to the EU's MiCA (Markets in Crypto-Assets Regulation) regime – and Hong Kong, where the Securities and Futures Commission (SFC) supervises virtual asset trading platforms (VATPs) under a mandatory licensing regime. Each offers genuine credentials. Neither is the automatic answer.
The choice between Malta and Hong Kong turns on four variables: the asset classes you trade or issue, the clients you serve, the jurisdictions where you want to passport or expand, and your appetite for the substance requirements each regulator imposes. This page maps both regimes against those axes, surfaces the practical differences that operators often discover only after committing capital, and closes with a decision matrix by business profile.
The Regulatory Architecture: Two Different Models
Malta operates within the EU regulatory perimeter. The MFSA's prior VFA framework established a domestic licence and a VFA agent requirement; under MiCA, Malta is transitioning to the CASP (Crypto-Asset Service Provider) authorisation, which carries EU-wide passporting rights across all member states and the EEA. Hong Kong operates as a stand-alone common-law jurisdiction. The SFC's VATP licensing regime is a domestic licence with no automatic recognition elsewhere – but it carries the reputational weight of one of Asia's premier financial centres.
The structural divergence matters immediately. A CASP authorisation obtained in Malta – as an EU member state – allows an operator to passport across the EU and EEA without re-applying in each country. That single fact is transformative for a business whose primary growth market is Europe. The SFC licence, by contrast, permits lawful operation in and from Hong Kong and is well-regarded by institutional counterparties, but it does not confer rights in Tokyo, Singapore or Sydney. Expansion into those markets requires separate engagement with MAS, the FSA or ASIC.
In our advisory practice, we see the passporting consideration misunderstood more often than any other. Operators assume that a Hong Kong licence gives them a "respected Asian base" from which to serve the continent. In regulatory terms, it gives them a Hong Kong licence.
What Can You Actually License?
Both regimes cover the core activities – exchange, custody, issuance – but they carve the perimeter differently, and that affects which licence a given business model actually needs.
Under the MiCA framework administered by the MFSA, the CASP authorisation encompasses advisory services, brokerage, custody, exchange, portfolio management, placing and transfer/settlement of crypto-assets. The framework also distinguishes between different token types: asset-referenced tokens (ARTs), e-money tokens (EMTs) and other crypto-assets, each carrying distinct whitepaper and issuer-authorisation obligations. An operator wishing to issue a stablecoin for use across the EU must engage the ART or EMT track, which carries its own reserve and redemption requirements under MiCA.
In Hong Kong, the SFC's VASP regime is focused on virtual asset trading platforms – entities that operate centralised exchanges where clients buy, sell or trade virtual assets. Custody of client assets sits within the VATP licence framework, but it can also arise as a regulated activity in its own right depending on how the custody function is structured. A token issuer or an investment fund holding virtual assets will need to map carefully whether its activities trigger the VATP regime or fall under the SFC's securities framework if the tokens qualify as securities under Hong Kong law.
The practical implication: a pure exchange operator finds a well-defined path in both jurisdictions. A business combining exchange, issuance and custody in one entity faces a more complex multi-licence question in Hong Kong, while MiCA provides a unified CASP authorisation that can encompass all three on a single authorisation document.
For a strong CTA bridge: The process above describes the standard path. Your facts – the entity structure, the token types, the user base, the banking – change the analysis materially.
To map the licence, banking and tax stack for your build, write to info@oboluslaw.com or reach us via Map your options.
How Much Substance Does Each Regulator Expect?
Both the MFSA and the SFC require genuine operational presence, not a brass-plate structure. The degree of substance demanded has intensified in recent years, and operators who underestimate this risk drawn-out applications or, worse, a licence grant followed by supervisory intervention when the substance commitment proves insufficient.
In Malta, the MFSA's expectations under MiCA align with European Banking Authority and ESMA guidelines on the governance of CASPs. A licensed entity is expected to have senior management resident in or at minimum regularly present in Malta, board-level accountability for risk and compliance, and systems that are actually operated rather than outsourced wholesale. The VFA agent concept – a licensed intermediary who vouches for the applicant's compliance – applies during the transitional phase; operators should understand whether a VFA agent relationship is still required for their application timeline.
The SFC in Hong Kong is direct about substance. The VATP framework requires that licensed platforms maintain their principal place of business in Hong Kong or have a branch registered there. Key personnel – the responsible officer and senior management – must be located in the jurisdiction. The SFC has made clear, in its published guidance, that it will assess whether the operational reality matches the licence application. Offshoring core compliance, risk management or technology functions to a group entity outside Hong Kong will draw scrutiny.
In practice, both regulators are asking the same underlying question: does the business actually run from here? The cost of answering "yes" in Hong Kong tends to be higher in absolute terms, reflecting commercial rents and staff costs in one of the world's most expensive cities. Malta offers a considerably lower cost base, which for a mid-sized operator can be a meaningful factor in the five-year plan.
AML, KYC and the Travel Rule
Both Malta and Hong Kong have implemented the Travel Rule – the obligation under the FATF Recommendations to pass originator and beneficiary data with a virtual asset transfer above the applicable threshold. Compliance with the Travel Rule requires investment in a compatible messaging protocol, integration with counterparty VASPs, and a policy for unhosted wallets. Neither jurisdiction permits a minimal approach to this.
Under MiCA and the EU's Transfer of Funds Regulation (TFR) – which governs the Travel Rule across the EU – the data-passing obligation applies to all crypto-asset transfers regardless of value, removing the de-minimis threshold that some other regimes retain. This is a notably stricter standard than many operators licensing in Malta from outside the EU anticipate. The MFSA, as an EU NCA, is bound by this EU-level rule.
Hong Kong's Travel Rule implementation follows the FATF standard, with a threshold set by the SFC's guidance. Operators should verify the current applicable figure directly, as the SFC has updated its AML/CFT guidance for VATPs since the licensing regime came into force. The SFC also requires licensed platforms to implement robust customer due diligence, transaction monitoring and suspicious transaction reporting to JFIU (the Joint Financial Intelligence Unit).
The cross-border AML consideration is equally significant. A Malta-based CASP serving clients across the EU must comply with the EU's AML directives as transposed in each member state where it passports – adding a layer of local compliance monitoring to the Malta base. A Hong Kong VATP serving clients in multiple Asian jurisdictions has no passporting benefit and must assess its AML obligations in each market independently.
Tax Treatment and Banking Access
Licensing jurisdiction and tax domicile are related but distinct decisions. Operators sometimes conflate the two, licensing in one place while managing their tax residency from another – a structure that can create permanent establishment risk if not designed carefully.
Malta's corporate tax regime is well-established. The headline rate and the refund mechanism for foreign shareholders are features that Malta has used to attract financial-sector businesses for decades. Whether those features benefit a digital-asset operator depends on the profit flows, the ownership structure and where the substance actually sits. We advise clients to map the tax stack alongside the licensing application, not after it.
Hong Kong's corporate tax rate is one of the lowest among major financial centres, applying only to profits arising in or derived from Hong Kong. For a VATP that generates revenue from global clients, the sourcing question – which profits are Hong Kong-source – is not always straightforward and benefits from early advice.
Banking access is, in our practice, the constraint that most frequently surprises operators at the point of application. Both Malta and Hong Kong have established banking relationships for licensed entities, but neither guarantees it. In Hong Kong, several major banks have opened accounts for SFC-licensed VATPs, regarding the licence as a signal of regulatory credibility; the process is thorough and relationship-driven. In Malta, the banking environment for crypto businesses improved as the VFA framework matured, but operators should expect a detailed due-diligence process regardless of their CASP authorisation status. MFSA authorisation helps; it does not replace bank KYC.
A recent matter illustrates the timing risk. A digital-asset fund seeking to launch from a European base had obtained preliminary licensing comfort in its chosen jurisdiction but had not commenced bank onboarding discussions until the licence was near finality. The bank's own diligence added several months to the launch timeline – months during which the market window the fund had identified shifted. We now structure client engagements so that banking conversations begin in parallel with the licence application, not after it.
How Long Does Each Application Take?
Application timelines in both jurisdictions depend on the completeness of the submission, the complexity of the business model and the workload of the regulator at the time of filing – factors that vary and cannot be stated as fixed figures without the risk of misleading a client whose facts are different.
As a qualitative guide based on what we observe in practice: Malta's MiCA CASP transition is still bedding in. Applicants who apply under the new CASP regime face a process that is more intensive than the legacy VFA registration, with ESMA coordination adding a layer of oversight. Operators who completed their VFA authorisation under the prior regime and are transitioning to CASP status face a different, generally shorter, path. A new applicant with no prior Malta history should budget for a process measured in multiple months, with thorough pre-application engagement with the MFSA strongly advisable.
In Hong Kong, the SFC's VATP licensing process has attracted significant applicant volume since the regime opened. The SFC has published information on its review process, but timeline expectations set at application can shift depending on the volume of queries the SFC raises on a given file. Responsible officer vetting, in particular, can extend timelines if the proposed individuals have complex histories or are based outside Hong Kong. Again, multiple months is the appropriate planning assumption.
In both jurisdictions, the single most common reason for extended timelines is a submission that requires substantial supplementation after filing. Pre-application preparation – a complete business plan, sound AML/KYC policies, credentialled key personnel and a fully documented governance structure – compresses the process materially.
If a prior application stalled or a regulator raised queries you found difficult to resolve, a second read of the file often surfaces the structural reason. Map your options with OBOLUS at info@oboluslaw.com.
Decision Matrix: Which Profile Should Consider Which Jurisdiction?
No jurisdiction is objectively superior. The right choice is determined by the operator's profile. The following matrix works through four common profiles; it is illustrative, not exhaustive, and specific facts always modify the analysis.
Profile A – EU-focused exchange or custodian. The primary growth market is Europe. The operator wants a single regulatory authorisation and the ability to offer services across EU member states without repeated local filings. Malta, as an EU member state with an established MFSA relationship with the crypto sector and MiCA passporting, is the natural starting point. The key risk is substance cost and the transition period as MiCA settles. Timeline: multiple months; the CASP process is substantive.
Profile B – Asia-Pacific exchange with institutional clients. The operator's clients are primarily institutional, based in or connected to the Asia-Pacific financial system. Banking relationships in Hong Kong are important. The SFC licence conveys credibility with those counterparties in a way that a Malta CASP may not. Key risk: no automatic expansion rights; subsequent markets require separate licensing. Timeline: multiple months; responsible officer vetting can be the long pole.
Profile C – Token issuer targeting European retail. The operator intends to issue a crypto-asset to EU residents, including retail clients. MiCA's whitepaper regime and CASP authorisation apply directly. Malta is relevant as the issuer-authorisation jurisdiction, subject to whether the token is an ART, EMT or other crypto-asset. Hong Kong does not provide an equivalent EU market-access right for the token distribution phase. This profile should look to Malta or another EU member state.
Profile D – Fund or asset manager with digital-asset strategies. The structure depends heavily on whether the assets under management are predominantly securities tokens (which trigger securities regulation in both places) or non-security crypto-assets. For a fund domiciled in the Cayman Islands or BVI but seeking a managed-account or advisory licence, the operator needs to assess whether the Hong Kong SFC's asset-management regime or Malta's CASP portfolio-management category is more efficient for the specific strategy. Neither is automatically simpler.
A fifth profile – the operator building a dual-hub structure, licensing in both Malta and Hong Kong to address both the European and Asian markets simultaneously – is operationally and commercially demanding. We have seen it work for exchanges with sufficient capital and management depth. For early-stage operators, it is generally preferable to establish one hub thoroughly before expanding.
What Operators Get Wrong: The Myth of the Single Offshore Licence
A common assumption among early-stage operators is that a single regulatory authorisation – from Malta, Hong Kong or anywhere else – is sufficient to serve clients globally without further regulatory engagement. This assumption is incorrect and carries material risk.
Both the MFSA and the SFC licence an operator to conduct regulated activities in or from their respective jurisdictions. A Malta CASP may passport across the EU. It does not authorise the operator to solicit or serve clients in Singapore, the United States, Australia or Japan without separate compliance steps in each of those markets. Hong Kong's VATP licence covers activities conducted in or from Hong Kong; it does not substitute for CFTC or SEC compliance when serving US persons, or for MAS requirements when serving Singapore residents.
The cross-border reality of digital-asset business – where the entity is licensed in one place, the server infrastructure sits in a second jurisdiction, the clients are spread across twenty countries and the banking runs through a third country's financial system – means that a rigorous licensing analysis maps the jurisdictional exposure at every layer: the entity, the product, the user base and the banking rails. We map the licence stack across those layers for every client engagement before they commit, because the cost of redesigning the structure post-launch is multiples of the cost of designing it correctly at the outset.
A second common mistake is treating the licensing question as separable from the tax and banking questions. All three are interconnected. A structure that optimises for one variable and ignores the others frequently creates problems that surface only when the business is operating and cannot easily be restructured.
Related at OBOLUS
- Licensing & Registration for Digital Asset Businesses – end-to-end licensing advisory across 70+ jurisdictions for exchanges, custodians and issuers
- Crypto Exchange Setup in Abu Dhabi Global Market (ADGM) – a detailed guide to the FSRA licensing process and substance requirements in the ADGM free zone
- Client Funds Safeguarding in the United States (Federal & State MTL) – the federal and state money-transmitter framework for digital-asset businesses serving US clients
FAQ
How long does a crypto licence take to obtain?
Timelines vary by jurisdiction, regulator workload and the completeness of the application. In Malta and Hong Kong, a well-prepared applicant should budget for a process measured in multiple months. Incomplete submissions, responsible-officer vetting queries or novel business models extend that window. Pre-application engagement with the regulator and thorough preparation of the governance and compliance documentation are the most effective ways to compress the timeline.
Which jurisdiction is best for licensing my crypto business?
There is no universally best jurisdiction. The right domicile depends on your primary market, asset classes, client profile and appetite for substance investment. A business targeting EU clients benefits from Malta's MiCA passporting. One serving institutional Asia-Pacific counterparties may find the SFC's credibility more valuable. The practical factors – banking access, substance cost and the tax stack – are equally determinative and must be assessed alongside the regulatory question.
Do I need a separate custody licence?
In both Malta and Hong Kong, custody of client virtual assets is a regulated activity. Under MiCA, custody and administration of crypto-assets on behalf of clients is one of the defined CASP services covered by the CASP authorisation. In Hong Kong, custody sits within the VATP framework for licensed platforms but may also arise as a standalone regulated activity depending on how the function is structured. Operators providing custody should confirm whether a single authorisation covers all their activities or whether a separate licence or permission is required.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before clients commit – because structure errors discovered at launch are expensive, and those discovered by a regulator are more so. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in multi-hub licensing strategy and regulatory authorisation for crypto exchanges, custodians and token issuers across EU and Asia-Pacific regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.