Operating a virtual asset trading platform (VATP) in Hong Kong without Securities and Futures Commission (SFC) authorisation is not an oversight — it is a criminal exposure. As regulators in the Asia-Pacific region tighten supervision of digital-asset businesses, the window for operating in regulatory grey zones is closing. Hong Kong's VASP licensing regime (virtual asset service provider framework) now requires any platform operator serving retail or professional investors from — or targeting — Hong Kong to hold an SFC-issued licence. The analysis below maps the regulatory basis, the process for an inbound operator, the cross-border considerations, and the practical decision points your board needs before committing capital.
Who Needs a VATP Licence Under Hong Kong Crypto Law?
Any business operating a centralized virtual asset trading platform that actively markets to or serves Hong Kong clients must be licensed under the SFC's VASP regime. The obligation applies regardless of where the corporate entity is incorporated. An exchange domiciled in the British Virgin Islands, Singapore, or the Cayman Islands is not exempt if its platform is accessible to Hong Kong users and it takes active steps to serve them. The SFC has made clear it will assess "nexus to Hong Kong" based on operational and marketing substance, not merely the registered office.
The practical perimeter is broader than many operators assume. Running order books, matching trades, or holding client assets on a platform that is accessible in Hong Kong – even without a Hong Kong entity – can engage the licensing requirement. In our practice, we routinely advise inbound operators who have underestimated this reach. The cost of getting that assessment wrong is enforcement, not just inconvenience.
Two additional categories attract scrutiny. First, operators offering staking, lending or yield products alongside exchange services may engage separate regulatory treatment depending on how those products are structured. Second, platforms carrying tokens that qualify as securities under Hong Kong law face parallel requirements under the Securities and Futures Ordinance, adding a second regulatory layer regardless of VASP status.
For a scoped assessment of your platform's Hong Kong nexus and licence obligations, contact OBOLUS at info@oboluslaw.com. The process above describes the standard perimeter analysis. Your entity structure, user base and product mix change the analysis materially.
The SFC VATP Licensing Framework: What It Covers
The SFC administers Hong Kong's VASP regime as a single-regulator model, with the VATP licence as the primary authorisation for exchange operators. The regime replaced the prior opt-in sandbox arrangement and made licensing mandatory for operators meeting the nexus test. The SFC's licensing rulebooks address capital adequacy, operational resilience, custody and segregation of client assets, governance, and the treatment of retail versus professional investors.
On the product side, the regime distinguishes between tokens that qualify as securities and those that do not. A platform that lists both must comply with conduct rules applicable to each category. Only tokens included on an SFC-approved list may be offered to retail investors. Institutional and professional-investor-only platforms face a different – though still demanding – compliance posture.
Custody sits at the centre of the SFC's expectations. Operators must demonstrate that client virtual assets are held separately from proprietary assets, with cold-storage requirements for a substantial portion of holdings. Operators who outsource custody must satisfy themselves – and the SFC – that the custodian meets equivalent standards. In our practice, we have seen applicants underinvest in custody infrastructure and face requests for supplementary information that add materially to the timeline.
What Does the VATP Application Process Look Like?
The SFC application process for a VATP licence is structured, document-intensive, and not self-service. Applicants submit a formal application package that includes business plans, organisational charts, risk management frameworks, compliance manuals, cybersecurity assessments, and evidence of minimum capital. The SFC reviews the application, may issue one or more rounds of queries, and grants or refuses authorisation. Timelines vary by applicant profile and application quality; in our experience with comparable SFC-supervised processes, a well-prepared application that attracts minimal queries will typically resolve in a matter of months rather than weeks.
A "deemed-to-be-licensed" transitional window applied to operators who were already active on Hong Kong's market as at a prescribed date and who made a timely notification. That window has a finite life, and operators who missed it or who are entering the market fresh must go through full authorisation. There is no shorter route for well-capitalised new entrants.
Key documents the SFC will scrutinise include the applicant's financial statements, the governance structure of the applicant entity, the qualifications and track record of responsible officers (the individuals personally accountable for regulated activities), and evidence of technology and cybersecurity standards. The responsible-officer requirement is a meaningful constraint: the individuals named must satisfy the SFC's fit-and-proper criteria and are personally on the hook for regulatory compliance.
Cross-Border Structure, Banking, and Tax: The Three-Sided Problem
For most inbound operators, the Hong Kong VASP licence is one layer of a multi-jurisdiction compliance stack – and rarely the most straightforward one. The entity that holds the SFC licence, the entity that holds client fiat, and the entity that interfaces with non-Hong Kong users may all sit in different jurisdictions. Getting that architecture wrong creates regulatory gaps, banking friction, and tax exposure simultaneously.
On the banking side, the reality is blunt: correspondent banking for crypto businesses in Hong Kong requires early, candid engagement with prospective banks. The major Hong Kong-licensed banks apply enhanced due-diligence to VATPs. Operators who approach banks after incorporation – without a compliance infrastructure already in place – routinely encounter delays or refusals. We have seen this pattern repeatedly. The bank relationship needs to be part of the pre-launch diligence, not an afterthought.
On the tax side, a Hong Kong entity operating an exchange benefits from Hong Kong's territorial tax regime, under which profits arising in or derived from Hong Kong are subject to profits tax at rates that are among the lower end of comparable financial centres. However, characterising which revenues are Hong Kong-source – particularly for a platform serving users across multiple jurisdictions – is a fact-specific exercise. Operators should not assume territorial exemption without a proper source analysis. Where non-Hong Kong group entities are involved, transfer pricing considerations add another layer.
The Travel Rule (the obligation, under FATF Recommendation 15, to pass originator and beneficiary data with virtual asset transfers above a defined threshold) applies to licensed VATPs in Hong Kong. Compliance requires a technical solution – typically a dedicated Travel Rule messaging protocol – integrated with the exchange's transaction flow. Operators coming from jurisdictions with lighter AML obligations often underestimate the implementation effort.
If your structure spans multiple hubs or a prior application stalled, write to OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw. A second read of your architecture often surfaces the structural gap and the route forward.
How Does Hong Kong Compare for an Inbound Operator?
Hong Kong sits at the credible-but-demanding end of the Asia-Pacific licensing spectrum. The SFC is a well-resourced, internationally respected regulator with a developed rulebook. A VATP licence from Hong Kong carries genuine weight with institutional counterparties, prime brokers, and banking partners – far more than a registration in a jurisdiction with lighter supervision.
The trade-off is cost and complexity. The capital requirements are material. The responsible-officer and governance demands require committed senior personnel. The ongoing compliance burden – audit, reporting, cybersecurity attestation, and the SFC's real-time supervision posture – is substantial. Operators whose primary market is elsewhere in Asia, or who serve only non-retail clients, should model whether the licence cost is justified by the Hong Kong opportunity before committing to the process.
For comparison, Singapore's Payment Services Act regime, administered by the Monetary Authority of Singapore (MAS), covers digital payment token service providers under a tiered structure. The MAS framework and the SFC VATP regime address different regulatory risks and carry different compliance architectures. Some operators hold both; others choose one as a regional anchor and manage access to the other market through a separate legal structure. Neither jurisdiction is categorically preferable – the choice turns on the operator's user base, product mix, and capital position.
The DIFC in Dubai – where VARA administers activity-based virtual asset licences for the Dubai mainland – is increasingly cited by Asian operators as a complementary hub for Middle East and South Asian distribution. Operating from both Hong Kong and Dubai through a holding-company structure is a pattern we are seeing more frequently in our cross-border practice.
A Common Assumption Is That an Offshore Licence Covers Hong Kong
The single most persistent misconception we encounter is that a Cayman Islands, BVI, or Seychelles registration is sufficient to serve Hong Kong clients, provided the operator has no local office. It is not. The SFC's nexus test is activity-based. Marketing to Hong Kong residents, listing Hong Kong-accessible trading pairs, accepting Hong Kong-linked payment methods, or employing Hong Kong-based staff can each, individually or collectively, bring the operator within the SFC's perimeter.
A second common assumption is that an offshore structure insulates the operator from Hong Kong's AML obligations. It does not. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance – Hong Kong's AML framework – applies to licensed VATPs and imposes customer due diligence, transaction monitoring, and record-keeping obligations that are broadly aligned with FATF standards. An operator carrying an offshore registration but serving Hong Kong clients faces both the unlicensed-activity risk and the AML-breach risk simultaneously.
A third assumption – particularly common among US-incorporated businesses – is that the SFC regime is analogous to SEC or CFTC registration. It is not structurally analogous. The VATP licensing obligations, the responsible-officer model, and the retail-token approval framework have no direct US counterpart. Operators need to approach the SFC process on its own terms, not through the lens of a familiar regime.
Micro-Matter: Navigating the Transition Window
In a recent engagement, an exchange operator that had been active in Hong Kong under the prior opt-in arrangement discovered, late in its transition planning, that its proposed corporate restructuring would exit the deemed-licensed window and require a fresh full application. We worked with the operator to sequence the restructuring and the application so that regulatory continuity was maintained and banking relationships were not interrupted during the process. The application was filed on a timeline that preserved the operator's ability to continue serving existing clients while the SFC reviewed the new structure. The matter underscored a point we raise consistently: in Hong Kong, the sequencing of corporate events relative to licensing milestones is as consequential as the substance of the application itself.
Decision Matrix: Which Operator Profile Should Pursue a Hong Kong VATP Licence?
Profile A – Institutional-focused exchange, regional anchor: A platform whose primary clients are professional investors and institutions, with strong capitalisation and existing compliance infrastructure, is well placed to pursue a Hong Kong VATP licence. The institutional-only track reduces the product-approval burden. Timeline to authorisation is a function of application quality; a well-resourced applicant with experienced responsible officers should plan for a multi-month process. The key risk is banking: early bank engagement is non-negotiable.
Profile B – Retail-oriented multi-product platform: An operator wishing to offer retail trading, staking, and yield products in Hong Kong faces the most demanding compliance posture. Retail token approvals, custody segregation, and SFC conduct rules all apply in full. Capital and governance requirements are at the upper end. Timeline is longer. The upside is a licence that opens the full Hong Kong retail market. Operators in this profile should model the cost carefully before applying.
Profile C – Asia-Pacific expansion from an existing hub: An operator already licensed by MAS in Singapore or by the SFC in a different capacity, seeking to add Hong Kong VATP access, should assess whether the incremental revenue justifies a second full-licence process. Some operators in this profile access Hong Kong institutional clients through back-to-back arrangements with a licensed VATP, rather than pursuing their own licence. That approach carries its own legal conditions and is not a universal solution.
Profile D – Early-stage operator, pre-product: An exchange still in development should front-load the regulatory analysis before committing to a Hong Kong entity structure. The cost of restructuring after the SFC has begun reviewing an application is material. Engaging counsel before the corporate filing – not after – is the decision that most often determines whether a later application succeeds.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – how OBOLUS maps the full licence stack across operating, custody, and payment layers
- UAE (VARA Dubai) vs. Switzerland: where to licence a crypto business – comparative analysis for operators choosing between two leading hubs
- Fund manager licensing from a cross-border perspective – structuring and regulatory analysis for digital-asset fund managers
FAQ
How long does a crypto licence take to obtain?
In Hong Kong, a VATP authorisation timeline varies by application quality, the completeness of submitted documentation, and the volume of SFC queries. A well-prepared application – with responsible officers already vetted, compliance infrastructure in place, and capital evidenced – can resolve in a matter of months. Applications with gaps in governance or cybersecurity documentation routinely take longer. There is no expedited track. Early engagement with experienced regulatory counsel materially improves predictability.
Which jurisdiction is best for licensing my crypto business?
No single jurisdiction is universally optimal. The right licensing hub depends on the operator's user base, product mix, capital position, and banking relationships. Hong Kong suits institutional and retail exchange operators seeking Asia-Pacific credibility and access to professional investors. Singapore is a strong alternative under the Payment Services Act. Dubai under VARA suits operators targeting the Middle East. Most serious operators end up mapping a multi-jurisdiction stack rather than relying on a single licence.
Do I need a separate custody licence?
In Hong Kong, custody of client virtual assets is addressed within the VATP licensing framework rather than as a standalone licence category at present. However, the SFC's custody and safeguarding expectations are detailed and demanding. Operators who outsource custody to a third party must satisfy the SFC that the arrangement meets equivalent standards. As the regulatory regime develops, standalone custody authorisation requirements may evolve. Operators should verify current SFC guidance at the time of application.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody, and payment layers before clients commit capital – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when things go wrong. To discuss your Hong Kong licensing situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in exchange authorisation, cross-border VASP structuring, and inbound licensing strategy across the Asia-Pacific region.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.