Operating a virtual-asset trading platform in Hong Kong without genuine economic substance is not a structural oversight – it is an enforcement trigger. The Securities and Futures Commission (SFC), which supervises virtual-asset trading platforms (VATPs) under the Hong Kong VASP licensing regime, expects licensees to be materially anchored in the territory: senior management present, risk and compliance functions staffed locally, and technology infrastructure capable of supporting real-time supervision. As regimes globally converge toward substance-first oversight, a letterbox entity holding an SFC licence is a liability, not an asset.
This page sets out what economic substance means for a licensed VASP in Hong Kong, how the SFC's expectations interact with tax and banking obligations, and where the cross-border structuring decisions become critical. The analysis addresses both inbound businesses seeking authorisation and operating licensees revisiting their footprint.
What Does Economic Substance Mean for a Licensed VASP in Hong Kong?
Economic substance, in the Hong Kong VASP context, means that the licensed entity has a real, functioning operational centre in the territory – not merely a registered address. The SFC's VATP licensing requirements demand that the licensed entity be incorporated in Hong Kong, that its key personnel (including the responsible officers) are resident and actively managing risk from within the jurisdiction, and that its fit-and-proper standards are met at the entity level, not at a group level offshore. The substance test, in practice, is an operational one: does the platform make material decisions in Hong Kong, or does it rubber-stamp decisions made elsewhere?
The SFC has stated publicly that it will scrutinise the governance structures of applicants and licensees. A licensed VATP that routes execution decisions, custody controls or compliance oversight to a parent in another jurisdiction, without genuine local authority, risks licence conditions, suspension or referral for enforcement. In our advisory practice, we see operators underestimate how granular this examination becomes at the annual review stage.
Substance is not a one-time threshold crossed at the point of authorisation. The SFC treats it as a continuing obligation. Regulatory examinations, whether scheduled or triggered by a material event, will look at payroll, management meeting minutes, decision logs and the geographic location of senior personnel. Businesses that build substance in for the application and then hollow it out post-authorisation face the sharpest regulatory risk.
What Does the SFC's VATP Licensing Regime Require at the Substance Baseline?
The SFC's VATP licensing framework requires the licensed entity to be a Hong Kong-incorporated company, with at least two responsible officers approved by the SFC and resident in Hong Kong. This is a structural baseline, not an aspiration. The responsible officers bear personal accountability for regulatory compliance and must be actively engaged in the day-to-day oversight of the business. An offshore group that appoints a local nominee responsible officer without genuine authority over risk and compliance is presenting a structure the SFC will look through.
Beyond the corporate structure, the SFC expects the following to be localised: the compliance function (including the AML/CFT officer), the risk management function, the technology and cybersecurity governance, and the cold storage or custody arrangements for client assets. Each of these has a staffing implication. The substance bill for a compliant VATP is not trivial – operators planning their entry should budget for a locally staffed team before they submit.
The SFC also requires that client assets held in Hong Kong are held under a trust structure governed by Hong Kong law, with an approved custodian. This custody requirement creates a second substance layer: the custodial function must itself meet localisation expectations, whether it is conducted in-house or by an approved third-party custodian operating in the jurisdiction.
Under the applicable VASP provisions, platforms dealing in securities-type tokens may also require a Type 1 and/or Type 7 licence under the Securities and Futures Ordinance in addition to the VATP licence. The overlap between the VATP licensing regime and the existing SFO licence regime is a structuring question every inbound operator must resolve before applying. Running the two regimes in parallel adds to the substance burden.
How Does Hong Kong Economic Substance Interact with the Tax Position?
Hong Kong operates a territorial tax regime: profits derived from a trade or business carried on in Hong Kong are taxable there; profits with an offshore source are not. For a VATP, this interaction cuts both ways. A business that builds genuine substance in Hong Kong – management, risk, operations – will generally be treated as carrying on its business in Hong Kong. Profits from trading activity, platform fees and ancillary services are likely Hong Kong-sourced on standard analysis.
The offshore-source exemption is not a planning tool for licensed VATPs in the way it might be for a holding structure. A VATP that argues its profits are offshore-sourced while simultaneously operating under an SFC licence that requires local management and decision-making is presenting inconsistent positions to different regulators. The Inland Revenue Department (IRD) is not bound by SFC filings, but the evidentiary record that demonstrates substance to the SFC is also the evidentiary record the IRD uses to determine taxability.
There is no capital gains tax in Hong Kong. Gains on disposal of digital assets held as capital assets are generally not subject to tax. Whether a gain is capital or revenue in nature depends on the facts – the frequency of transactions, the period of holding and the intention at acquisition. In our practice, token treasury positions held by operating VATPs are a regular source of uncertainty. The treatment of staking rewards, liquidity provision income and on-chain yield is an area where the IRD has not yet published definitive guidance, and conservative treatment is warranted until it does.
For groups with an offshore parent or holding structure, the substance built in Hong Kong for licensing purposes will anchor the functional analysis under transfer pricing rules. Intercompany arrangements – IP licensing, management fees, intra-group loans – must reflect the economic reality that the Hong Kong entity is doing real work. Under-pricing the local entity's contribution is a transfer pricing risk that has been rising in prominence across the region.
Do Banks in Hong Kong Require Substance Before Opening Accounts for VATPs?
Banks operating in Hong Kong apply an enhanced due diligence standard to virtual-asset businesses, and they use physical substance as a primary risk signal. A licensed VATP with a local team, a local office, a local compliance officer and audited accounts prepared in Hong Kong is a materially different onboarding proposition than an offshore entity holding an SFC licence. In our experience, the substance indicators that matter most to banking counterparties are: a locally signed lease, locally employed compliance staff, a locally appointed auditor and evidence that the responsible officers are resident.
The banking environment for VATPs in Hong Kong improved materially following the HKMA's guidance to authorised institutions on virtual-asset businesses, but access remains selective. Banks apply their own risk appetite frameworks. An operator that meets the SFC's substance requirements will not automatically obtain a bank account – but an operator that cannot demonstrate genuine local substance will almost certainly fail the bank's own assessment. The two processes reinforce each other.
Cross-border payment flows add complexity. A VATP processing client onramps and offramps in multiple currencies will need FPS access (for Hong Kong dollar transactions), correspondent banking relationships for major currency pairs, and a documented approach to the Travel Rule (the obligation to pass originator and beneficiary data with each qualifying transfer). The Travel Rule obligation under the applicable Hong Kong VASP provisions is not satisfied by a policy document – it requires implemented technology, tested workflows and a counterparty identification protocol. Banks will ask to see this at onboarding and at periodic review.
For a VATP operating across Hong Kong, Singapore or other regional hubs, the banking and substance analysis must be run jurisdiction by jurisdiction. A Hong Kong SFC licence does not passport to Singapore's MAS regime, and the operational footprint required by each regulator must be assessed independently. Consolidating group functions to reduce cost while maintaining multi-jurisdiction licences is a design exercise that requires legal, tax and banking inputs to be considered together.
What Is the Process and Timeline for an Inbound VASP Seeking a Hong Kong Licence?
The SFC's VATP licensing process involves a formal application, a detailed review of the business plan, governance documents, AML/CFT policies, technology and cybersecurity assessments, and fit-and-proper vetting of responsible officers. The process is not fast. Timeline varies by applicant complexity, the quality of the submission and the SFC's current workload – operators should treat the process as a matter of months, not weeks, and build their staffing and substance plan around a realistic go-live horizon.
The application will require a demonstration of substance from the outset. Applicants that have not yet incorporated in Hong Kong, have not identified resident responsible officers and have not established local compliance infrastructure will face fundamental questions early in the review. Experienced counsel can identify these gaps at the pre-application stage and sequence the build correctly – substance first, then submission.
A pre-application consultation with the SFC is possible and, for most inbound operators, advisable. It allows the regulator to flag jurisdictional concerns and gives the applicant a clearer picture of the information requirements for their particular business model. We regularly advise on structuring the pre-application engagement to present the business clearly and address the substance question directly before the formal clock starts.
Post-authorisation, the SFC conducts ongoing supervision. Licensed VATPs are subject to periodic inspections, cybersecurity reviews and financial resource requirement monitoring. The substance obligations are not static – as the business scales, the SFC expects the local team to scale with it. A growth plan that moves decision-making offshore to manage costs will create tension with the licence conditions.
For a micro-matter reference: In a recent licensing matter, a mid-sized exchange group sought to operate under a Hong Kong VATP licence while maintaining its risk and compliance function in a lower-cost jurisdiction. We advised on the restructuring of the governance architecture, the relocation of the responsible officers and the adjustment of the intercompany service agreement. The application was submitted with a substance profile that addressed the SFC's published expectations, and the group proceeded to authorisation without a request for additional information on governance. The banking relationship was established concurrently with the licence application, using the localised compliance documentation as the primary onboarding material.
What Are the Most Common Substance Mistakes That Cost VASP Applicants Their Licence?
The most consistent error we observe is timing: operators build the business plan, negotiate the technology stack and set the commercial launch date – and then address substance as a secondary item. By the time the application is prepared, the substance gap is structural and cannot be papered over with an affidavit from an offshore director who plans to visit Hong Kong quarterly.
A second common error is treating substance and tax efficiency as competing objectives. They are not necessarily in conflict, but they must be designed together. An operator that builds a Hong Kong entity as the licensed VATP, a BVI or Cayman holding company for the IP, and a Singapore entity for institutional sales needs a consistent functional analysis across all three. If the Hong Kong entity is doing the real work, the transfer pricing must reflect that. If it is not, the licensing regime will say otherwise. The inconsistency is the problem.
A third error is ignoring the custody layer. Many operators focus on the platform licence and treat custody as an operational afterthought. The SFC's requirements for client asset protection are substantive. An operator without a clear custody structure – whether in-house with the required capital and governance, or via an approved third-party custodian – will not obtain authorisation. We regularly advise on whether operators should build the custody capability internally or contract it out, and the answer depends on balance sheet, technology and the group's risk appetite.
A Common Assumption: One Offshore Licence Covers Global Operations
A common assumption among operators early in their licensing journey is that a single offshore registration – whether in the BVI, Cayman Islands or a comparable jurisdiction – is sufficient to serve clients across multiple markets. This assumption does not survive contact with the actual regulatory environment. Hong Kong's SFC licence is required to operate a virtual-asset trading platform in Hong Kong or to actively market to Hong Kong users. An entity licensed elsewhere and serving Hong Kong clients from offshore is operating without authorisation under the applicable VASP provisions.
The same logic applies in the other direction. An SFC-licensed VATP wishing to serve users in Singapore must assess whether MAS licensing under the Payment Services Act is required. A Hong Kong licence does not create any cross-border permission. The licensing and substance requirements of each jurisdiction must be assessed on their own terms.
This is not a reason to avoid multi-jurisdiction operations. It is a reason to plan them properly. Operators we advise routinely maintain licences across two or three hubs – Hong Kong, Singapore and a European CASP under MiCA being a common configuration – with substance built to satisfy each regulator independently and group functions allocated in a way that is consistent across all of them.
For a scoped assessment of your substance and licensing position across multiple hubs, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
Which Operator Profile Should Choose Hong Kong as a Primary Licensing Hub?
Hong Kong is the right primary hub for an operator whose core business is a retail or institutional trading platform targeting the Asia-Pacific region, whose technology team is already based in or willing to relocate to Hong Kong, and whose institutional investor base is in Greater China or Southeast Asia. The SFC licence carries brand credibility with institutional counterparties and with banks across the region. For that profile, the substance cost is justified by the commercial access.
A Singapore-first structure under MAS is more appropriate for an operator whose regional focus is Southeast Asia, whose banking relationships are established there, and whose compliance team is already within the MAS framework. Singapore and Hong Kong are not mutually exclusive – many operators license in both – but the primary substance anchor should follow the commercial centre of gravity.
For operators primarily serving European retail or institutional clients, a CASP (crypto-asset service provider) authorisation under MiCA at an EU-member-state level provides EU-wide passporting and should be the primary hub. Hong Kong can then function as the Asia subsidiary with its own SFC-compliant substance profile. The transfer pricing and governance design for a Hong Kong-EU dual structure requires careful planning to ensure consistency.
Operators building custody-only or stablecoin-related services should take separate advice on whether the VATP licence is the right instrument. The SFC's regime is designed primarily for trading platforms, and the fit for pure-custody or stablecoin business models requires a bespoke analysis.
If a prior application stalled or a banking relationship closed, a fresh structural review can identify whether a substance deficiency was the underlying cause. To pressure-test your structure before you recommit, message us via t.me/oboluslaw or write to info@oboluslaw.com. Map your options.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end VASP authorisation strategy across 70+ jurisdictions
- Digital-asset licensing in the Isle of Man – what inbound businesses need to know about the Isle of Man's DeFi-friendly regime
- Payment institution licensing for regulated entities – structuring the payment layer around your VASP or exchange licence
FAQ
How long does a crypto licence take to obtain?
Timeline varies materially by jurisdiction and applicant complexity. In Hong Kong, the SFC's VATP licensing process typically runs for several months from submission of a complete application. Gaps in substance planning – no local responsible officers, incomplete AML documentation, unresolved custody structure – extend the timeline significantly. We advise building the substance infrastructure before the application is submitted, not concurrently with it.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your user base, the assets you deal in, your banking relationships and the regulatory credibility required by your institutional counterparties. Hong Kong suits platforms focused on Asia-Pacific with a local operational anchor. Singapore, the EU under MiCA and the UAE under VARA each serve distinct commercial profiles. We map the full licence, banking and tax stack for each business before recommending a primary hub.
Do I need a separate custody licence?
In Hong Kong, a VATP is required to maintain client asset safeguarding arrangements that meet the SFC's standards. Whether custody is conducted in-house as part of the VATP licence or contracted to an approved third-party custodian depends on your balance sheet, technology and risk governance. In other jurisdictions – including Singapore and certain EU member states – custody is a separately regulated activity requiring its own authorisation. The answer is jurisdiction-specific and business-model-specific.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when things go wrong. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP authorisation strategy and economic substance planning across Hong Kong, Singapore and the UAE.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.