Digital-asset custody authorisation in Hong Kong is a regulated activity requiring specific approval under the VASP licensing regime administered by the Securities and Futures Commission (SFC). Any business holding client virtual assets in Hong Kong – whether as its core offering or as an ancillary service to trading – must obtain the appropriate authorisation before operating. Proceeding without that authorisation exposes the business to enforcement action, loss of banking relationships and reputational damage that is very difficult to reverse.
This page sets out the regulated basis for custody in Hong Kong, the application process for an inbound operator, the cross-border tax and banking interaction, and the decision points that determine whether a Hong Kong structure makes commercial sense for your operation.
Why custody is a regulated activity in Hong Kong
Custody of virtual assets in Hong Kong is a regulated activity because it falls within the scope of the SFC's VASP licensing regime, which covers the operation of a virtual-asset trading platform (VATP) and the associated safeguarding of client assets. The SFC treats the holding of client virtual assets as integral to the conduct of a regulated activity – not as a separate, exempt function. That interpretation has significant consequences for any business that custodies assets as part of a broader service stack.
The regime applies to entities operating in Hong Kong and, critically, to those actively marketing their services to Hong Kong investors. Physical presence in the territory is not the only trigger. An offshore custodian directing sales efforts toward Hong Kong clients without authorisation faces the same regulatory exposure as one with a local office. In our practice, we regularly advise inbound operators who initially assumed that a non-Hong Kong entity could serve local clients without triggering the SFC's jurisdiction. That assumption is incorrect under the current regime.
The SFC's posture is consistent with the broader direction of leading digital-asset hubs. The Securities and Futures Commission has made clear that investor-protection obligations – including asset segregation and the safeguarding expectations that flow from them – apply with equal force in the virtual-asset context as in traditional finance. A custodian operating outside those expectations is not merely unlicensed; it is operating in a manner the SFC has explicitly identified as posing risk to clients.
What licence categories cover custody?
Under the SFC's VASP licensing regime, the primary authorisation for a virtual-asset trading platform captures custody as a component of the regulated activity, rather than as a standalone licence type in all cases. An operator running a VATP that also holds client assets requires VATP authorisation, and the SFC's licensing conditions then impose detailed custody-specific obligations as part of that authorisation.
The position is more nuanced for a business whose sole or primary function is custody – holding virtual assets for third parties without operating a trading venue. Operators in that position need to assess carefully whether their activities bring them within the regulated perimeter and, if so, which authorisation pathway the SFC expects them to follow. The SFC has issued detailed guidance on the asset-safeguarding obligations that apply, covering segregation of client assets, cold-storage requirements, insurance expectations and counterparty due-diligence standards.
Two structural considerations arise immediately for any inbound operator. First, the SFC's licensing conditions for custody are operationally demanding. Meeting them requires advance preparation on technology, insurance and operational resilience – not just legal paperwork. Second, a business that provides custody as part of a broader group structure – for example, a Hong Kong VATP entity whose assets are actually held by an affiliated offshore entity – must demonstrate to the SFC that the custody arrangement meets local standards regardless of where the holding entity sits.
For a scoped assessment of where your custody model sits under the SFC regime, contact OBOLUS at info@oboluslaw.com. The process above describes the standard regulated perimeter. Your entity structure, user base and banking will change the analysis in ways that are specific to your facts. Map your options
How does the VATP authorisation process work for a custody operator?
The SFC's VATP authorisation process is sequential, documentation-intensive and involves active dialogue between the applicant and the regulator throughout. The SFC does not operate a passive file-and-wait system. Applicants should expect detailed queries on governance, technology infrastructure, anti-money laundering controls and the specific custody arrangements proposed.
At the pre-application stage, the SFC expects an operator to be able to demonstrate that its governance structure is established, its responsible officers are identifiable and fit, and its key operational systems are in place or at an advanced stage of readiness. Applications submitted before those foundations are in place tend to draw prolonged regulatory questions rather than prompt determinations.
The application itself requires a comprehensive submission package. That includes corporate structure charts, business plans, financial projections, AML/CFT programme documentation, technology assessments and the detailed custody arrangements – including storage ratios, key management procedures and insurance coverage. The SFC reviews each element and may request supplemental information at multiple points in the process.
Timeline varies by the complexity of the business model and the completeness of the initial submission. Straightforward applications from well-prepared operators are resolved in a matter of months; complex structures or incomplete submissions extend that materially. The SFC does not publish binding determination periods, and applicants should plan their commercialisation timelines around realistic regulatory windows rather than optimistic projections. In our practice, operators who engage counsel before submitting – rather than after receiving the first query – consistently reach determination faster.
A micro-matter from our recent experience illustrates the operational point. In a recent licensing matter, a custodian with an established offshore operation sought to obtain SFC authorisation to serve Hong Kong institutional clients. The initial application was returned with detailed queries on cold-storage architecture and the governance of key-management ceremonies. We restructured the technical documentation, coordinated an independent technology assessment and resubmitted with a comprehensive response to each query. The application proceeded to determination on the resubmission without further material queries.
What AML and Travel Rule obligations apply?
A Hong Kong-authorised VASP is subject to full AML/CFT obligations aligned with the Travel Rule – the international standard, derived from FATF Recommendation 15, requiring originators and beneficiaries of virtual-asset transfers to pass identification data with the transaction. The SFC and the Hong Kong Monetary Authority have both issued guidance on implementation expectations, and the Travel Rule applies to virtual-asset transfers above the applicable threshold.
For a custody operator, the Travel Rule interacts with custody in two specific ways. Where the custodian initiates or receives transfers on behalf of clients, it must collect and pass the required originator and beneficiary information. Where it holds assets and routes instructions to a trading venue or another custodian, the transfer obligations run between the entities involved. A custody model built on the assumption that holding assets is passive and therefore exempt from Travel Rule requirements is not sustainable under the current SFC and FATF-aligned regime.
The SFC also expects strong counterparty due-diligence practices. A custodian routing assets to or from unhosted wallets must apply enhanced scrutiny. The practical implication is that custody compliance is not a single control layer – it runs across onboarding, transaction monitoring and the technical infrastructure that supports both. Operators who treat AML compliance as a documentation exercise rather than an operational one routinely encounter problems at the SFC's supervisory review stage.
How does cross-border banking and tax interact with a Hong Kong custody structure?
The cross-border dimension of a Hong Kong custody authorisation is, in our experience, where the practical complexity concentrates. Obtaining SFC authorisation is achievable with well-prepared counsel. Operationalising the structure – opening fiat banking, establishing correspondent relationships and managing the tax profile of the Hong Kong entity – requires a parallel workstream that many operators underestimate.
Hong Kong's tax regime is territorial. A Hong Kong-incorporated entity is assessed only on profits arising in or derived from Hong Kong. For a custody operator whose clients are predominantly offshore, the question of whether fee income is Hong Kong-sourced requires careful analysis. The answer is not always straightforward when infrastructure, personnel and clients are distributed across jurisdictions. We advise structuring the operating entity and its intra-group arrangements with that analysis completed before banking and regulatory onboarding begins – not after.
Banking for digital-asset businesses in Hong Kong is available through a number of institutions, though access depends on the nature of the business, the AML programme quality and the applicant's ability to explain the business model clearly. The SFC's authorisation is a significant positive indicator for banks, but it does not guarantee banking access. Operators we advise routinely find that banking and licensing are parallel processes rather than sequential ones – and that the SFC authorisation is more persuasive to a bank when the operator can demonstrate a fully operational compliance programme alongside it.
For operators sitting between Hong Kong and another licensing hub – for example, a group with a Singapore MAS licence and a proposed Hong Kong SFC authorisation – the interaction between the two regimes requires coordination. MAS and the SFC take different positions on certain custody matters, and a group compliance policy built around one regime may need adjustment for the other. Allied counsel in the relevant jurisdiction provide the local perspective; OBOLUS coordinates the cross-border picture.
If your structure spans more than one licensing hub and you need the banking and tax layers mapped alongside the regulatory application, write to OBOLUS at info@oboluslaw.com. A prior application that stalled or a banking relationship that closed can usually be assessed for the structural reason behind it. Map your options
Which operator profiles should choose Hong Kong for custody authorisation?
Hong Kong is best suited to custody operators with a genuine Asia-Pacific institutional client base, the operational and capital resources to meet SFC's detailed authorisation conditions, and the governance maturity to sustain ongoing supervision in a rigorous regulatory environment. It is not the right first-choice licensing venue for early-stage operators seeking a light-touch entry point.
Profile A: an established custodian with institutional clients in East and Southeast Asia, existing compliance infrastructure and the ability to demonstrate SFC-standard cold-storage and insurance arrangements. This operator should pursue VATP authorisation directly and plan for the full documentation and dialogue process described above. The SFC regime offers genuine commercial value – access to institutional Hong Kong and regional mandates that require local authorisation.
Profile B: an operator whose clients are predominantly in the EU or the Americas, with a modest Asia-Pacific book that does not yet justify the cost and complexity of full SFC authorisation. This operator should consider whether the Hong Kong entity is the right vehicle for the Asia-Pacific piece or whether a Singapore MAS-licensed entity, serving Hong Kong clients on a cross-border basis within the permitted parameters, is a more proportionate step. We map that decision for clients before they commit capital to an application.
Profile C: a new entrant building a custody offering from the ground up and evaluating jurisdiction. Hong Kong offers a strong regulatory credential and access to deep capital markets. But the SFC's expectations on operational readiness before authorisation are high. An operator that cannot demonstrate functioning cold-storage architecture, a named compliance officer and an operational AML programme at the time of application will face a difficult process. For this profile, the question is whether to build to Hong Kong standards before applying or to obtain a lighter-touch interim licence in another jurisdiction while the Hong Kong application is in progress.
The decision is not purely regulatory. It turns on the client base, the capital available to fund the authorisation and compliance build, the banking relationships already in place, and the competitive imperative to operate in Hong Kong specifically. We have seen operators that delayed Hong Kong entry by twelve to eighteen months to complete the compliance build achieve faster and cleaner authorisations than those who applied prematurely.
What are the most common mistakes in the SFC custody authorisation process?
The most common mistake is treating the SFC's VATP authorisation as a documentation exercise rather than a governance and operational readiness assessment. The SFC reviews whether the applicant can operate a custody business safely – not merely whether it can produce paperwork describing how it would. An operator that files comprehensive documents but whose key personnel cannot speak credibly to the operational details will encounter difficulty at the assessment stage.
A second persistent mistake is underestimating the insurance requirement. The SFC expects custodians to hold insurance coverage commensurate with the assets under custody, and the insurance market for digital-asset custody risk is neither cheap nor readily accessible to new entrants. Operators who begin exploring custody insurance only after filing the application routinely find that the process extends materially as a result.
A third mistake – particularly relevant for group structures – is failing to address the intra-group custody arrangement in the initial application. Where a Hong Kong entity is the regulated face of a custody operation but assets are physically held by an affiliated entity elsewhere, the SFC expects that arrangement to be disclosed, documented and shown to meet Hong Kong safeguarding standards. Structuring that explanation clearly, and demonstrating that it does not create a gap in client-asset protection, is a material part of the application for any group operator.
A common assumption we encounter is that a single offshore licence is sufficient to serve clients globally, including in Hong Kong. That assumption is wrong. The SFC's regime applies to businesses actively marketing to Hong Kong clients regardless of the entity's domicile. Operators relying on an offshore authorisation to serve the Hong Kong institutional market without SFC approval are exposed to enforcement risk and will find that sophisticated counterparties and banks increasingly require sight of a local authorisation.
Related services at OBOLUS
Related at OBOLUS
- Licensing and registration for digital-asset businesses – full-scope licensing support across 70+ jurisdictions, from scoping to authorisation
- VASP licensing in El Salvador – the regulatory process and commercial case for a BTC-era licensing hub
- Worldwide freezing orders: a legal guide for digital-asset businesses – how WFOs work in the context of digital-asset disputes and recovery
FAQ
How long does a crypto licence take to obtain?
Timeline depends on jurisdiction, licence category and the completeness of the application. In Hong Kong, well-prepared VATP applications are resolved in a matter of months; complex structures or incomplete submissions extend that materially. Other regimes vary from a few weeks for registration-based frameworks to over a year for full authorisation. The single most reliable way to shorten the process is to engage counsel before filing rather than in response to regulator queries.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on where your clients are, the nature of your regulated activities, your capital and compliance resources, and the banking relationships you need to operationalise the structure. Hong Kong is strong for institutional Asia-Pacific custody. Singapore suits payments and DPT services with a regional user base. EU operators need MiCA CASP authorisation to passport within the bloc. We map the full licence, banking and tax stack before recommending a primary jurisdiction.
Do I need a separate custody licence?
In Hong Kong, custody is addressed within the VATP authorisation framework rather than through a standalone licence in all cases, but the SFC imposes detailed custody-specific conditions as part of that authorisation. In other regimes – including several EU member states under MiCA – custody of crypto-assets is a distinct regulated service requiring specific authorisation. Whether you need a separate instrument depends on your jurisdiction, your business model and the scope of your regulated activities. A scoped assessment will confirm the position for your specific structure.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – structuring licensing, banking and tax as one mandate rather than three disconnected workstreams. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in cross-border VASP authorisation and digital-asset regulatory strategy across Asia-Pacific and the Gulf hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.