Operating a digital-asset business in Hong Kong without the correct authorisation is not a calculated risk – it is an enforcement event waiting to happen. The Securities and Futures Commission (SFC) has moved decisively to bring virtual-asset trading platforms inside its regulatory perimeter, and the message from the regulator is unambiguous: unlicensed operation in or from Hong Kong will attract investigation, injunction and, in serious cases, criminal referral. For any exchange, custodian or token intermediary with Hong Kong users, counterparties or incorporated entities, the licensing question is not optional.
Hong Kong has built one of the most structurally distinct virtual-asset service provider (VASP) regimes in the Asia-Pacific region. The SFC sits at the centre of it. Under the applicable VASP licensing provisions, platforms operating a virtual-asset trading platform (VATP) must obtain SFC authorisation before they serve Hong Kong investors. That obligation extends to platforms operating outside Hong Kong if they actively market to persons in the territory. A single offshore registration – a common assumption among founders – does not neutralise that exposure. This page maps the regime, the process, the substance expectations and the cross-border dimensions that every operator needs to understand before committing capital.
The Regulator and Its Perimeter
The SFC is the sole licensing authority for virtual-asset trading platforms in Hong Kong, and its perimeter is broader than many operators initially expect. The VASP licensing regime covers platforms that operate a centralised exchange service for at least one security token – and, following the 2023 regulatory expansion, extends to platforms trading non-security virtual assets if they choose to apply for the additional regulatory permissions. The SFC publishes a list of licensed and applicant VATPs; operating without appearing on that list while serving Hong Kong investors is a clear breach of the applicable provisions.
The regime does not capture every participant equally. Token issuers, over-the-counter desks with no custody function, pure DeFi protocols and certain institutional-only arrangements may fall outside the VATP licence perimeter – but each of those carve-outs has boundaries. In our practice, we regularly advise clients who assumed they were outside the perimeter only to find that one element of their service model – automated order matching, custodial wallet infrastructure, or a Hong Kong incorporated entity – brought them squarely within it. The SFC has signalled it will look at substance, not labelling.
Separately, the Hong Kong Monetary Authority (HKMA) oversees stablecoin issuance under a developing regime. Operators with a stablecoin component must track HKMA guidance alongside the SFC's VATP framework. The two regimes do not yet fully overlap, and structuring decisions made now will affect which authorisation path applies when the stablecoin rules mature.
Licence Categories: Who Needs What?
The SFC's VASP regime centres on the virtual-asset trading platform (VATP) licence, but the precise scope of what a given operator needs depends on the activities it conducts and the assets it handles. The core distinction is between a platform that trades security tokens and one that trades non-security virtual assets – and most commercially significant exchanges sit across both categories simultaneously.
A VATP licence authorises a platform to operate an exchange service. It does not, by default, authorise the platform to provide asset management or advisory services to clients. Those activities, if bundled into the product, require separate authorisation under the Securities and Futures Ordinance. We have seen operators launch an "earn" or "managed portfolio" feature without realising that it triggered a Type 9 (asset management) licence obligation alongside the VATP. The SFC's coordination with the Securities and Futures Ordinance regime means the licence map for a full-service platform is multi-layered.
Custody of client assets is addressed within the VATP framework as an ancillary condition rather than a standalone licence category, but the SFC's custody requirements – segregation, cold-storage ratios and insurance expectations – are substantive. Operators who rely on a third-party custodian must satisfy the SFC that the custodial arrangement meets the applicable standards. Whether a custodian itself requires separate authorisation depends on the nature of the assets and whether any securities-related activity is involved.
What Does the VATP Application Process Look Like?
The VATP application process is a structured, multi-stage review by the SFC that typically extends across several months from initial submission to a licensing decision – with the precise duration varying by the complexity of the applicant's business model, the completeness of the submission and the volume of regulatory inquiries the SFC raises. Applicants who submit complete, well-documented files consistently experience shorter review cycles.
At a high level, the process moves through the following stages. First, the applicant prepares and submits a comprehensive application package. This includes a detailed description of the business model, ownership and governance structure, key personnel fit-and-proper information, financial projections, technology and cybersecurity assessments, AML/CFT policies and an investor protection framework addressing token admission criteria. Second, the SFC conducts a substantive review and raises queries – often multiple rounds. Third, where the SFC is satisfied, it issues an in-principle approval subject to conditions. The applicant then implements those conditions before the licence is formally issued.
In practice, the application is not a form-filling exercise. The SFC expects sophisticated, evidenced responses. A cybersecurity assessment that simply lists policies without penetration-test results, or an AML framework that does not address on-chain transaction monitoring, will generate queries that add weeks to the timeline. We map the submission against the SFC's published standards before anything is filed – because a complete first submission is the most reliable timeline accelerant available.
To assess your platform's readiness for a VATP application, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base, the asset categories – change the analysis in ways that a general overview cannot capture.
What Substance Does the SFC Expect?
Substance is not a threshold the SFC states as a single figure; it is a composite of governance, staffing, technology and financial-resource expectations, each assessed on a case-by-case basis. An applicant with an entity in Hong Kong but all decision-makers offshore, no local compliance officer and no local bank account will face hard questions about whether it is genuinely operating from the jurisdiction.
The SFC's expectations on capital adequacy, insurance, cold-storage ratios and operational resilience are detailed in the applicable VATP requirements. Capital requirements vary by the type and scale of the platform's activities. The SFC has indicated publicly that it applies a rigorous fit-and-proper test to both the entity and its responsible officers – a record of regulatory sanction, material litigation or dishonesty in any jurisdiction is likely disqualifying.
Responsible officers (ROs) are a structural requirement. A VATP must appoint individuals who are approved by the SFC and who carry personal regulatory accountability for the platform's conduct. Sourcing qualified ROs with a track record acceptable to the SFC is often the most constrained step in the process. In our practice, we routinely advise clients on RO selection and preparation before the application is filed, because a weak RO profile is one of the most common causes of application delay or rejection.
Financial resources requirements mean the platform must be able to demonstrate not just current solvency but ongoing capital adequacy across a stress scenario. The SFC is explicit that it will not approve a platform that could not withstand a period of market dislocation without compromising client assets.
AML, CFT and the Travel Rule in Hong Kong
Hong Kong's AML/CFT framework for virtual assets is anchored in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), and the SFC has incorporated FATF's virtual-asset guidance – including the Travel Rule (the obligation to pass originator and beneficiary data with a virtual-asset transfer) – into its licensing requirements for VATPs. This is not a soft expectation; Travel Rule compliance is a condition of the licence, and the SFC will examine whether the platform has implemented an operationally effective solution before granting authorisation.
The Travel Rule creates a practical cross-border problem. A Hong Kong-licensed VATP must pass originator and beneficiary information with every qualifying transfer. Where the counterparty is a VASP in a jurisdiction that has not implemented an equivalent requirement, or where the receiving wallet is unhosted, the platform must have a documented policy for how it handles that gap. Operators we advise regularly discover that their Travel Rule solution works for intra-exchange transfers but breaks down at the point of withdrawal to external wallets – a gap the SFC will identify during its review.
Customer due diligence, transaction monitoring and suspicious transaction reporting obligations are imposed under the AMLO and elaborated in the SFC's circulars. On-chain analytics – the use of blockchain forensics tools to screen incoming and outgoing transactions for sanctions exposure, mixer activity or darknet associations – is treated by the SFC as a baseline expectation for any licensed platform, not an enhancement.
Cross-Border Structuring: Where Do Hong Kong and the Broader Stack Interact?
For most operators, a Hong Kong VATP licence does not operate in isolation. The entity structure, the banking arrangements and the user base typically span multiple jurisdictions – and the legal obligations that attach to those other elements do not disappear because the platform holds a Hong Kong licence.
A common structure places the licensed VATP entity in Hong Kong with a holding company in the British Virgin Islands or the Cayman Islands. That is a legitimate and frequently used architecture. But the regulatory obligations of the BVI or Cayman entity under their respective VASP regimes – the BVI FSC under the Virtual Asset Service Providers Act and the Cayman CIMA under the Virtual Asset (Service Providers) Act – apply independently. Assuming that the Hong Kong licence covers the group is a structural error we see repeatedly.
Banking is the second pressure point. Hong Kong-incorporated crypto entities have historically experienced challenges opening and maintaining bank accounts. The SFC licence does not resolve banking access; it is a necessary but not sufficient condition. An operator needs to approach banking in parallel with licensing, and the banking strategy must account for the entity's AML posture, its transaction volumes and its counterparty risk profile. We work through the banking stack alongside the licence application to avoid the scenario where a licence is granted to an entity that cannot open an account.
Tax is a third dimension. Hong Kong's territorial profits tax regime means that offshore-sourced income may fall outside the charge to tax – but "offshore" sourcing for a platform with local infrastructure, local staff and local clients is not straightforward to establish. The Inland Revenue Department's approach to crypto businesses continues to develop, and structuring decisions made at the licensing stage have direct tax consequences.
If your group structure spans Hong Kong, BVI or Cayman entities, or you are mapping the banking and tax stack alongside the licence, write to OBOLUS at info@oboluslaw.com. A prior application that stalled or a bank account that was closed often reflects a structural issue the second read can surface.
Which Operator Profiles Should Prioritise Hong Kong?
Hong Kong is not the right primary licence for every operator, and a candid jurisdiction assessment should precede any filing commitment. That said, the regime has specific attributes that make it compelling for particular profiles.
A centralised exchange with serious institutional ambitions in the Asia-Pacific region benefits from the reputational signal the SFC licence provides. Hong Kong's status as a leading international financial centre means that a licensed VATP can credibly approach institutional counterparties – asset managers, family offices, corporate treasuries – who would not engage with an unlicensed or lightly regulated platform. The SFC licence is, in this market, a credibility infrastructure as much as a legal permission.
Operators primarily serving retail users in markets where other jurisdictions offer lower barriers – Singapore's MAS payment services licensing, Malta's MFSA CASP authorisation under MiCA, or a BVI VASP registration for an entity with no direct retail marketing – may find the cost-benefit calculation points elsewhere. The SFC's regime is substantive and the ongoing compliance burden is real. It is designed for operators who intend to build a durable, regulated business with Hong Kong-connected users or counterparties, not for entities seeking the lightest-touch registration available.
Operators with a token issuance element should be aware that the VATP licence does not cover the token offering itself. A security token offering (STO) requires its own SFC authorisation, and the conditions attach to the offering prospectus and the distribution process separately from the exchange licence. In our practice, we map the issuance and exchange licences together from the outset, because decisions made in the STO structure affect the token's admissibility to the licensed exchange.
A Representative Engagement
In a recent licensing matter, an Asia-Pacific exchange group had incorporated its principal entity in Hong Kong and begun accepting client registrations without completing the VATP application. The SFC's public register showed no application on file. We were engaged to assess the exposure, restructure the onboarding flow to remove the unlicensed activity, prepare and file a complete VATP application, and brief the group's RO candidates on the fit-and-proper process. The application was filed within a defined preparation window, the unlicensed activity was suspended pending authorisation, and the group's banking relationships – which had been under review – were stabilised once the regulatory position was clarified to the banks.
What Are the Most Common Mistakes in a Hong Kong Crypto Licence Application?
Experience across multiple VATP application processes reveals a consistent set of mistakes that delay or derail filings. Understanding them before submission is the most efficient form of risk management available.
The first is submitting an incomplete technology and cybersecurity assessment. The SFC's cybersecurity expectations are detailed and evidence-based. A high-level policy document is not sufficient; the SFC expects penetration-test results, a documented incident-response procedure and evidence of resilience testing. Applicants who file without this invariably receive a query that halts the review while the assessment is supplemented.
The second is inadequate token admission criteria. Every VATP must have a documented process for determining which tokens it will list. The SFC expects that process to address legal classification (security or non-security), liquidity, market manipulation risk and the token project's governance. A platform that lists tokens without documented admission criteria signals to the SFC that investor protection is not embedded in the operating model.
The third is the RO gap. Responsible officers who cannot demonstrate relevant experience in financial services or digital assets, or who carry regulatory history from other jurisdictions, will not satisfy the SFC's fit-and-proper standard. This is the mistake that most often cannot be remedied quickly – finding and preparing qualified ROs takes time, and it should begin before the application is drafted.
The fourth is treating the Hong Kong licence as a group-wide authorisation. As noted above, group entities in other jurisdictions carry their own regulatory obligations. A clean Hong Kong application filed alongside an unregistered BVI holding company creates a group risk that the SFC may surface during its ownership and control review.
A common assumption worth addressing directly: some operators believe that holding a licence in a lighter-touch jurisdiction – a Cayman registration, a BVI VASP filing, or an EU CASP authorisation obtained in one member state – is sufficient to serve Hong Kong investors without SFC authorisation. That assumption is incorrect. The SFC's perimeter applies wherever the activity touches Hong Kong investors, regardless of where the platform is incorporated or licensed.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the firm's full licensing practice, covering 70+ jurisdictions and the end-to-end authorisation process.
- Licence Renewal and Variation for Early-Stage Founders – guidance on maintaining and varying an existing licence as the business model evolves.
- Oracle and Data-Feed Liability: Legal Counsel for Digital-Asset Firms – legal analysis of data-infrastructure risk for platforms using third-party price feeds and oracles.
FAQ
How long does a crypto licence take to obtain?
In Hong Kong, a VATP application to the SFC typically runs across several months from initial submission to a licensing decision – the precise timeline depends on the complexity of the business model, the quality of the submission and the volume of SFC queries. A complete, well-prepared filing materially reduces the review period. In other jurisdictions, timelines range from a matter of weeks for lighter-touch registrations to well over a year for complex full-authorisation processes. Your specific timeline should be mapped against the applicable regime before you commit resources.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are, what activities you conduct, what capital and substance you can deploy, and what banking environment you need. Hong Kong suits operators with institutional Asia-Pacific ambitions and a full exchange model. Singapore's MAS regime suits certain payment and DPT service models. EU CASP authorisation offers passporting across the single market. A BVI or Cayman registration serves specific holding-company or fund structures. We map the licence, banking and tax stack together – because the right licence in the wrong banking environment creates its own problems.
Do I need a separate custody licence?
In Hong Kong, custody of client virtual assets by a VATP is addressed within the VATP licence framework as a condition, not a separate licence category – but the SFC's custody standards are substantive, covering segregation, cold-storage ratios and insurance. If a third-party custodian is used, the VATP must satisfy the SFC that the custodial arrangement meets those standards. In other jurisdictions – including under the MiCA CASP regime and under MAS – custody of digital assets is a separately regulated activity that may require its own authorisation alongside a trading or exchange licence.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around every operating structure. We map the licence stack across operating, custody and payment layers before you commit – because the structural decisions made at the licensing stage have compliance, banking and tax consequences that follow the business for years. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in Asia-Pacific VASP and exchange licensing, with a focus on SFC VATP authorisation and cross-border entity structuring for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.