Operating a virtual-asset trading platform in Hong Kong without a current, correctly scoped licence exposes the business to suspension, enforcement and the loss of banking relationships that took years to build. Licence renewal and variation under the Hong Kong SFC (Securities and Futures Commission) VASP licensing regime are mandatory, time-sensitive processes – not administrative formalities – and the consequences of missing a window or operating outside an authorised scope are immediate. This page sets out the regulated basis, the practical renewal and variation mechanics, the cross-border dimensions that operators must manage alongside the SFC process, and the decision points that determine whether to engage specialist counsel early.
What is the regulatory basis for VASP licensing in Hong Kong?
The SFC administers the VASP licensing regime (virtual-asset service provider licensing) for virtual-asset trading platforms operating in or targeting Hong Kong. The regime sits within the broader securities and regulatory perimeter and requires platforms to obtain and maintain a licence before operating a centralised exchange that handles virtual assets. The licensing obligation attaches to the activity, not just the legal domicile of the entity: a platform incorporated offshore that actively markets to Hong Kong users is within the SFC's reach.
Critically, the regime distinguishes between a licensed platform and a platform merely registered or tolerated under a transitional arrangement. As the transitional window closes, operators that assumed legacy tolerance would persist indefinitely have found that assumption costly. In our practice, we have seen businesses that delayed the formal licensing step lose banking access precisely when the transitional period lapsed – because correspondent banks treat an unlicensed operator as an unacceptable counterparty the moment the grace period ends.
The SFC's VASP licensing regime covers virtual-asset trading platform operators; custody, dealing and advisory activities carried on in connection with the platform may also trigger separate regulatory permissions under the applicable Securities and Futures Ordinance provisions. The interaction between the VASP track and existing type-1 and type-7 regulated-activity licences is a structural question every multi-service operator must resolve before renewal.
To discuss whether your current authorisation scope matches your live business model, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base geography, the banking – change the analysis. Map your options
What does the renewal process actually require?
Renewal under the SFC VASP regime requires a formal application submitted before the licence expiry date; operating on an expired licence is an offence under the applicable regime provisions. The renewal is not automatic. The SFC reassesses the licensee's continued fitness and propriety, its compliance with ongoing conditions, and whether the scope of the licence still matches the services actually provided.
The practical renewal checklist spans several workstreams running in parallel. First, the operator must confirm that its responsible officers and ultimate beneficial owners remain fit and proper to the SFC's standard. Any change in senior personnel since the original grant – including new directors, new majority shareholders or changes to the group structure above the licensed entity – must be notified and may trigger a concurrent variation. Second, the AML/CFT programme must be current: the SFC expects documented policies, a current risk assessment and evidence of a functioning transaction-monitoring system that meets the Travel Rule (the obligation to pass originator and beneficiary data with a transfer). Third, the financial requirements – solvency, liquid capital, professional indemnity insurance – must be satisfied at the point of application.
In a recent renewal matter, an exchange operator that had restructured its group following a seed-funding round discovered that the new holding structure had not been notified to the SFC. The variation to reflect the holding-company change had to be filed concurrently with the renewal, effectively extending the review period. We worked through the notification sequence with the operator and prepared a consolidated submission that addressed both the structural change and the renewal, avoiding a gap in authorisation.
Timeline for renewal is not fixed in the publicly available SFC materials and varies with the complexity of the file – in our cross-border practice, operators with clean compliance histories and no concurrent variations have seen reviews resolved more quickly than those with open conditions or structural changes. Operators should treat renewal as a workstream that begins no later than three months before the expiry date.
When does an SFC licence require a formal variation?
A formal variation is required whenever a licensed operator wishes to add, remove or modify the scope of its authorised activities in a way that falls outside the terms of the current licence. The variation obligation is broader than many operators expect.
Common variation triggers include: launching a staking or lending product that was not within the original scope; adding a custody function for client assets; expanding to new virtual-asset classes that were not contemplated in the original application; changing the legal entity through which the service is delivered; or making material changes to the technology or custody arrangements that underpin the platform. The SFC's rulebooks set out the notification and pre-approval steps; the key discipline is that an operator must not begin operating the new activity until the variation is granted, not merely applied for.
Operating outside the approved scope – even incidentally, as a result of a new product launch – is treated by the SFC as an unlicensed activity. The regulatory risk is not hypothetical: the SFC has demonstrated a willingness to issue public reprimands and to impose conditions or suspensions on operators that expand services without obtaining the required variation. We regularly advise operators on the pre-launch scoping analysis that determines whether a new product requires a variation, a new licence type, or merely an internal policy update.
How does the Hong Kong licence interact with cross-border operations and banking?
For most digital-asset operators, the Hong Kong VASP licence is one layer of a multi-jurisdiction structure – and the renewal or variation of that licence triggers compliance obligations across every other layer. This is the dimension that purely domestic counsel frequently misses.
Consider a typical structure: a Cayman Islands holding company owns a Hong Kong licensed operating entity. The group banks in Singapore. The technology infrastructure is operated from a European subsidiary. A variation to the Hong Kong licence – for example, adding a new virtual-asset class – may require a parallel notification to the Cayman entity's registered agent (where economic-substance rules apply to the activities conducted), a review of whether the Singapore banking relationship's terms permit the new activity, and an assessment of whether the European entity crosses any MiCA threshold. These workstreams do not move at the same speed, and the failure to sequence them correctly creates a window during which the business is technically compliant in Hong Kong but non-compliant elsewhere.
Banking is the most immediate pressure point. Correspondent banks and digital-asset-friendly banks in Singapore, the UAE and the EU each conduct periodic reviews of their VASP clients. A renewal that produces a gap in authorisation – even a matter of days – or a variation that changes the scope of the licence without an updated comfort letter to the bank can trigger account closure. In our practice, we have seen otherwise well-run operators lose banking during the renewal window because no one had sent the bank a proactive update confirming the renewal was in process and the licence remained valid.
The Travel Rule obligations under the FATF Recommendations (Recommendation 15) also intensify at renewal: the SFC expects the renewal submission to reflect a mature Travel Rule compliance programme, including counterparty due diligence on other VASPs. If the programme has not kept pace with the growth of the business – particularly where the operator has added new virtual-asset classes or expanded to new geographic corridors since the original licence was granted – the renewal process will surface those gaps.
If a renewal or variation is interacting with a banking review or a cross-border regulatory notification, the timelines must be managed together. Write to OBOLUS at info@oboluslaw.com to map the sequence. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options
What are the tax and structuring implications of renewal and variation?
Renewal and variation are not purely regulatory events – they are the moment at which the substance of the licensed business is formally reassessed, and that reassessment intersects directly with the group's tax and structuring posture.
Hong Kong operates a territorial tax regime: profits sourced in Hong Kong are subject to profits tax; offshore profits are not. A variation that brings new activities within the licensed scope – for example, extending the platform to cover more virtual-asset classes, or adding a custody service – may shift the source-of-profits analysis for the enlarged business. Operators that have relied on an offshore-profits position for part of their income must reconfirm that position after any material variation, because the SFC's approval of the variation is not a tax authority ruling and does not bind the Inland Revenue Department.
Similarly, where the Hong Kong entity sits beneath a Cayman or BVI holding structure, an expansion of the licensed business at the Hong Kong level may affect the economic-substance analysis for the holding entities. The Cayman economic-substance regime and the BVI VASP Act each have their own triggers; a variation at the Hong Kong operating level that increases the proportion of value generated by the Hong Kong entity can affect the substance assessment of the group as a whole. We coordinate with allied counsel in the relevant jurisdictions to ensure the tax and substance analysis moves in step with the regulatory renewal.
What are the most common mistakes operators make at renewal and variation?
The most costly mistake is treating renewal as an administrative task rather than a regulatory event. Operators that assign renewal to a junior compliance officer without partner-level oversight consistently underestimate the SFC's expectation of a substantive fitness-and-propriety reassessment and a current AML/CFT programme review.
A second recurring mistake is failing to identify, before the renewal submission is filed, whether the business as currently operated matches the licensed scope. In a number of matters we have handled, the operator had informally expanded its services during the licence period – adding a new virtual-asset class in response to market demand, or providing staking-adjacent services that were not clearly within the original scope – without filing a variation. The renewal process then surfaced the gap, converting a routine renewal into a concurrent enforcement matter.
Third: poor sequencing of the cross-border notifications. The Hong Kong SFC process does not pause while the Singapore banking review resolves. Operators that do not map the full sequence before filing often find that one workstream blocks another at the worst possible time.
A common assumption is that a single offshore licence – or a transitional registration – is sufficient to continue serving clients globally while the full licensing stack is built. In practice, the SFC's reach extends to platforms that actively market to Hong Kong users regardless of incorporation, and correspondent banks increasingly require a current, fully scoped licence in each operating jurisdiction before they will maintain the relationship. The offshore-licence-is-enough assumption has cost operators both their banking and their ability to operate in the Hong Kong market.
When should an operator engage specialist counsel?
The decision to engage specialist counsel for a renewal or variation is most valuable when at least one of the following is true: the group structure has changed since the original licence was granted; a new product or asset class is being added; the operator is also managing a banking review, a tax structuring exercise, or a cross-border notification obligation in parallel; or the renewal is coming up against the expiry date with less than two months remaining.
For operators with a clean compliance history, no structural changes and a simple product scope, the renewal may be manageable internally with counsel on call for document review. For any operator in the categories above, the analysis is different. The cost of a gap in authorisation – in enforcement risk, banking disruption and reputational damage with the SFC – dwarfs the cost of early counsel engagement.
Operators considering a variation alongside renewal should treat the two processes as a single project from the outset. The SFC's review of a concurrent renewal and variation is more intensive than either alone, and the filing sequence matters: a variation filed after a renewal application is already under review may restart the clock.
- Profile A – Exchange operator, clean compliance history, no structural change, single virtual-asset class: renewal is a defined-scope project; counsel reviews the AML programme and the responsible-officer declarations, and manages the SFC correspondence. Timeline qualitatively: weeks, not months, for a straightforward file.
- Profile B – Multi-service platform, group restructure since original licence, adding custody and staking: renewal and variation run concurrently; cross-border notifications to holding-entity jurisdictions run in parallel; banking comfort letters must be dispatched early. Timeline: materially longer; begin the workstream at least four months before expiry.
- Profile C – Operator approaching expiry date with an undisclosed structural change or an out-of-scope service already live: treat as urgent; the variation must be filed before the renewal is submitted, and the disclosure to the SFC must be proactive and complete. Counsel engagement is immediate.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – end-to-end licensing advice across 70+ jurisdictions for exchanges, custodians and token issuers.
- Economic substance for licensed VASPs in the Cayman Islands – how the Cayman economic-substance regime interacts with a VASP licence at the holding-company level.
- Cross-chain bridge legal risk for regulated entities – the regulatory and liability implications of bridge technology for licensed platform operators.
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction, licence type and the complexity of the applicant's group structure. In Hong Kong, the SFC's review of a new VASP application is intensive and is not subject to a fixed statutory deadline; operators with straightforward structures and complete submissions generally receive an outcome faster than those with complex group arrangements or open compliance issues. In our cross-border practice, operators should plan for a process measured in months, not weeks, and should not commit to a product launch date until the licence is in hand.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right licensing strategy depends on where your users are, where your entity will bank, what services you will offer, and what your investors require. Hong Kong suits operators that want SFC credibility and access to the Asia-Pacific market. The UAE (VARA and ADGM/FSRA) suits operators targeting the Middle East. MiCA-authorised CASP status in the EU allows passporting across member states. We map the licence, banking and tax stack for your specific build rather than defaulting to a single recommendation.
Do I need a separate custody licence?
In most leading jurisdictions, custody of client virtual assets is a regulated activity in its own right. Under the SFC VASP regime in Hong Kong, safeguarding of client assets is a core obligation of the licensed platform, but an operator also running a stand-alone custody business for third parties may require an additional authorisation. Under MiCA in the EU, crypto-asset custody and administration is a separately authorised CASP service. The answer is fact-specific: what assets, for which clients, under which arrangement. We assess the custody structure as part of any licensing scoping exercise.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – ensuring the structure holds when banking and regulatory reviews collide. Our disputes team also coordinates freezing relief and on-chain tracing across leading common-law forums when the situation demands it. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialises in VASP licensing, renewal and variation across the Asia-Pacific and Gulf hubs, with a focus on multi-layer licence structures for exchange and custody operators.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.