EMI licence for crypto firms in Hong Kong
Operating a crypto firm in Hong Kong without the correct authorisations exposes the business to enforcement action, suspended banking relationships and the loss of access to one of Asia's most consequential financial markets. The EMI licence (electronic money institution authorisation under the Stored Value Facility, or SVF, regime) and the VASP licence (virtual asset service provider authorisation under the Securities and Futures Commission's VATP framework) are distinct instruments that often need to run in parallel for a crypto business handling fiat conversion, custody and trading. Hong Kong's regulatory architecture is sophisticated, and the question of which authorisation a given business needs – and in which sequence – turns on product design, not on corporate preference.
This page sets out the regulatory basis for each instrument, the application process as it applies to inbound crypto operators, the cross-border interaction with banking and tax, and the decision point at which a business should commit to structure before filing.
The Hong Kong regulatory environment for digital-asset businesses
Hong Kong now operates one of the most structured digital-asset regulatory regimes in the Asia-Pacific region, administered by two principal regulators: the Securities and Futures Commission (SFC), which oversees virtual-asset trading platforms under the VATP licensing regime, and the Hong Kong Monetary Authority (HKMA), which supervises stored value facilities under the Payment Systems and Stored Value Facilities Ordinance. For a crypto firm that combines trading, custody and fiat payment functionality, both regulators are relevant – and both have the authority to take enforcement action against unlicensed activity.
The SFC's VATP regime, which became mandatory for centralised virtual-asset exchanges, requires platforms to hold a Type 1 (dealing in securities) and Type 7 (providing automated trading services) licence in addition to the specific VASP authorisation. The HKMA's SVF regime applies where a firm issues or operates a stored value instrument that can be used to pay third parties. Many crypto businesses handle both functions. In our practice, the first question we ask a new Hong Kong instruction is whether the client issues a value-denominated instrument or merely facilitates transfers of existing tokens – because that distinction determines whether the HKMA is in the room from day one.
What is an EMI licence in Hong Kong, and who actually needs one?
In Hong Kong, the closest functional equivalent to a European EMI licence is the Stored Value Facility (SVF) licence issued by the HKMA, which authorises a firm to issue a multi-purpose stored value instrument redeemable by third parties. A crypto firm needs an SVF licence if it issues a wallet, prepaid card or token that a user can redeem at merchants or transfer to third parties for value – not merely if it holds crypto on a user's behalf. The boundary matters enormously: a pure custody or trading function falls outside the SVF regime and inside the SFC's VATP and custody-licensing perimeter instead.
Businesses we advise frequently assume that operating a fiat on-ramp or maintaining user balances in stablecoins automatically triggers the SVF regime. That is not invariably correct. The trigger is the issuance of a stored value instrument accepted by persons other than the issuer. A firm that converts fiat to crypto and holds the resulting tokens in a segregated custody structure may sit within the SFC's framework without any HKMA filing requirement. However, if the same firm issues a stable-value instrument redeemable at partner merchants, the HKMA becomes the lead regulator for that product line. The practical consequence is that a dual-function crypto-and-payments business will face a layered filing process across both authorities.
For a scoped assessment of how your product design maps to the Hong Kong licence matrix, contact OBOLUS at info@oboluslaw.com. The product facts determine the filing sequence, the capital commitment and the banking strategy before a single form is filed. Map your options
How does the SFC VATP regime apply to inbound crypto exchanges?
The SFC's VATP licensing regime is the primary authorisation path for a centralised digital-asset exchange operating in or from Hong Kong, and it applies to platforms that offer trading services to retail and professional investors alike. Inbound operators – that is, foreign-incorporated entities seeking to establish a Hong Kong presence – must establish a local corporate entity, appoint fit-and-proper responsible officers, and satisfy the SFC's requirements on capital adequacy, custody arrangements, AML/CFT systems and cybersecurity. The capital requirements are set by the SFC and vary by the scope of licensed activities; they are not published as fixed thresholds available to general commentary, and a business should obtain current figures directly from the SFC or through counsel.
The application process involves an initial pre-application meeting with the SFC, submission of a detailed business plan and policy documentation, assessment of key personnel, and a licensing fee. The SFC's published guidance indicates a thorough vetting process; in practice, well-prepared applications with complete documentation and experienced compliance personnel move faster than those filed speculatively. Operators we advise on SFC VATP submissions consistently find that the quality of the AML/CFT framework and the robustness of the custody policy are the two areas that generate the most SFC queries during review.
The SFC also operates a transitional framework for existing platforms that were operating prior to the mandatory licensing date. For new market entrants, no transitional path applies – a clean licence application is required before any retail-facing activity begins.
What does the HKMA SVF licence process require for a crypto firm?
The HKMA SVF licensing process is distinct from the SFC path and is administered under a separate statutory framework. An applicant must demonstrate that the stored value instrument is backed by adequate safeguarding arrangements, that the firm has strong governance and operational resilience, and that the business model does not expose the payments system to undue risk. The HKMA applies a principles-based assessment rather than a mechanistic checklist, and its expectations on capital and float management reflect the monetary-system concerns of a central bank supervisor rather than a securities regulator.
For crypto firms, the SVF application requires careful drafting of the product terms to delineate clearly what the instrument represents, how redemption works and how float is held. A stablecoin-adjacent product that promises par-value redemption will attract closer scrutiny of the reserve backing than a closed-loop loyalty token. In recent engagements, we have seen the HKMA ask applicants to restructure the redemption mechanics of their product before proceeding – a process that takes weeks if addressed proactively, and months if treated as a compliance afterthought.
A practical note on sequencing: a crypto firm that needs both an SFC VATP licence and an HKMA SVF licence should treat these as parallel tracks with a shared corporate-governance and AML/CFT spine, not as sequential filings. The legal entity structure, the responsible officer appointments and the compliance manual must serve both regulators simultaneously. Filing the SFC application first without considering the SVF requirements often produces a policy architecture that needs to be rebuilt.
How do banking and tax interact with Hong Kong crypto licensing?
Banking access is the operational bottleneck that most inbound crypto operators underestimate. Hong Kong's licensed banks apply enhanced due diligence to digital-asset businesses regardless of whether those businesses hold SFC or HKMA authorisations, and account opening for a newly licensed crypto firm is not a formality. In our cross-border practice, we regularly advise clients that a credible banking strategy requires pre-application engagement with at least two to three banks, supported by a detailed business plan, a compliance summary and evidence of the pending or granted licence.
The cross-border dimension adds a further layer. A Hong Kong-licensed entity that also serves users in other jurisdictions – the EU, Singapore or the United Kingdom, for example – must assess whether those jurisdictions impose independent licensing or registration requirements for the services being provided from Hong Kong. MiCA (the EU's Markets in Crypto-Assets Regulation) does not recognise third-country equivalence in the way that some earlier directives did; a Hong Kong VATP licence does not passport into the EU. Similarly, the MAS (Monetary Authority of Singapore) applies its own Payment Services Act framework to firms soliciting Singapore-based users, regardless of where the firm is licensed.
On tax, Hong Kong operates a territorial corporate profits tax regime. Income sourced in Hong Kong from licensed digital-asset activities is taxable; gains on capital account are generally not. The treatment of staking rewards, trading profits and custody fees requires analysis under the Inland Revenue Ordinance, and the interaction with the home-country tax position of the operating entity's shareholders adds a further variable. These are not questions to resolve after the licence is granted – they affect the choice of entity structure from the outset.
What AML and Travel Rule obligations apply to Hong Kong crypto businesses?
Hong Kong's AML/CFT framework for virtual-asset service providers aligns with FATF Recommendation 15 and the Travel Rule (the obligation to pass originator and beneficiary data alongside a virtual-asset transfer). The SFC and HKMA both impose AML/CFT obligations on their respective licensees, and the Travel Rule applies to virtual-asset transfers above the applicable threshold. The precise threshold is set by the HKMA and SFC in their published guidance and is subject to change; operators should verify the current figure with counsel or directly with the regulator before designing their compliance systems.
In practice, Travel Rule compliance for a Hong Kong-licensed platform requires integration with a VASP-to-VASP messaging protocol (such as TRISA or one of the commercially available Travel Rule solutions) and a policy for handling transfers where the counterparty VASP is unhosted or non-compliant. The SFC has been explicit that Travel Rule compliance is a condition of VATP authorisation, not a post-licensing enhancement. Firms that arrive at the application with a Travel Rule solution already implemented, tested and documented have a materially stronger application than those that describe it as a roadmap item.
Decision matrix: which licence does your Hong Kong crypto business actually need?
The licence profile of a Hong Kong crypto business turns on its product architecture, its user base and its custody model. Three common operator profiles illustrate the decision logic.
A centralised exchange offering spot trading in virtual assets to Hong Kong-connected investors requires the SFC VATP licence and the associated Type 1 and Type 7 SFC licences. If that exchange also maintains fiat float in user accounts pending conversion, it should assess whether that float constitutes a stored value instrument. If it does, the HKMA SVF licence is also required. The key risk for this profile is launching trading services before the VATP licence is granted – a violation of the SFC regime that carries significant enforcement exposure.
A payments and remittance business using stablecoins or tokenised fiat to move value across borders primarily engages the HKMA's SVF regime and the money services operator registration administered by the Customs and Excise Department. The SFC is relevant only if the instruments transferred qualify as securities or the platform trades virtual assets for investment purposes. The timeline for this profile depends heavily on the reserve and redemption structure of the instrument.
A custody-only operator – a firm that holds virtual assets on behalf of institutional clients without operating a trading platform – falls within the SFC's custody licensing requirements and the associated capital and segregation rules. No HKMA filing is required unless the custodian also issues a stored value product. The custody path is sometimes overlooked by operators who assume that custody of client assets is a lower-risk activity requiring less regulatory engagement; the SFC's expectations on safeguarding, insurance and technology risk are demanding.
A recent cross-border licensing matter
In a recent matter, a Southeast Asian payments firm sought to establish a Hong Kong presence to serve institutional clients with a combined trading and fiat-settlement product. The initial application strategy targeted the SFC VATP licence only. On reviewing the product design, we identified that the settlement layer – a firm-issued, merchant-redeemable instrument – engaged the HKMA's SVF regime as well. We restructured the entity architecture to separate the trading entity (SFC-facing) from the payments entity (HKMA-facing), drafted the AML/CFT framework to serve both regulators on a shared spine, and coordinated the banking engagement across two institutions simultaneously. The client entered both application processes with a policy architecture that addressed the material queries each regulator was likely to raise, reducing the number of regulatory requests during review.
If your application has stalled or your product design has changed since you first engaged with the SFC or HKMA, a second read of the structure can surface the issue and the route forward. Write to OBOLUS at info@oboluslaw.com. Map your options
Related at OBOLUS
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full licence stack across 70+ jurisdictions, custody, payments and trading layers
- VARA licence application in the Isle of Man – a comparative jurisdiction view for operators weighing their entry structure
- Smart contract dispute resolution in El Salvador – on-chain and off-chain remedies for digital-asset disputes in an emerging crypto-law jurisdiction
FAQ
How long does a crypto licence take to obtain?
Timelines vary significantly by jurisdiction, regulator and the completeness of the application at submission. In Hong Kong, the SFC VATP process is thorough and the HKMA SVF review is principles-based; both can run from several months to over a year for a well-prepared application. Applications with incomplete documentation, unresolved AML/CFT gaps or personnel who do not meet fit-and-proper standards take materially longer. Engaging counsel before filing reduces avoidable delays.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your product type, your target user base, your banking relationships and your tax position. Hong Kong suits businesses with genuine Asia-Pacific market ambitions and the ability to meet its capital and governance standards. Other operators may find that Singapore under the MAS Payment Services Act, a VARA licence in Dubai, or a MiCA CASP authorisation in the EU better serves their specific profile. We map the full licence stack before a client commits to any filing.
Do I need a separate custody licence?
In Hong Kong, custody of virtual assets for clients is a regulated activity overseen by the SFC, and it carries distinct capital, safeguarding and technology-risk requirements that sit separately from the VATP trading licence. A firm that holds client assets – even as an ancillary function – should assess whether its custody activity triggers a standalone authorisation requirement. In most other flagship jurisdictions, custody is similarly treated as a distinct regulated activity. Bundling it into a trading licence without analysis is a common structural error.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit to a filing strategy – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums, including the DIFC Courts, England and Wales, and Hong Kong. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialises in multi-regulator licensing strategies for inbound digital-asset businesses in the Asia-Pacific region, with a focus on SFC and HKMA authorisation processes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.