Hong Kong SFC VASP Licence: 2026 Application Guide

The Securities and Futures Commission's 1 June 2023 deadline for the mandatory VASP licensing regime under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) has now matured into a live enforcement environment. By late 2025, the SFC had published its first batch of licensing decisions and issued public warnings against unlicensed platforms still soliciting Hong Kong users. If your exchange, OTC desk, or trading platform touches Hong Kong retail clients and you're not licensed or in the deemed-to-be-licensed queue, you're operating on borrowed time.

TL;DR

• Any centralised platform operating a virtual asset exchange in Hong Kong must hold an SFC VASP licence under AMLO Schedule 1 (effective 1 June 2023).
• Applicants must satisfy minimum paid-up capital of HK$5 million, liquid capital requirements, and fit-and-proper tests for responsible officers.
• The SFC's "deemed-to-be-licensed" transitional window closed 29 February 2024 for new entrants; only platforms that applied before that date retain transitional status.
• Retail access triggers additional product suitability, token due diligence, and insurance/compensation obligations beyond the institutional-only baseline.
• Non-compliance carries criminal liability: up to 7 years imprisonment and HK$5 million fines under AMLO s.53ZRK.

---

What This Regulation Actually Requires

The Statutory Framework

Hong Kong's VASP regime sits inside the AMLO, specifically Part 5B inserted by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. Schedule 1 of the AMLO defines "virtual asset" broadly: it captures cryptocurrencies, utility tokens with secondary-market trading, and security tokens not already caught by the Securities and Futures Ordinance (SFO). Stablecoins backed by fiat are currently excluded pending the separate stablecoin licensing bill, but that carve-out is narrow.

Operating a "virtual asset exchange" without a licence is a criminal offence. The definition covers any platform that provides facilities for buying, selling, or exchanging virtual assets, whether the operator is incorporated in Hong Kong or merely marketing to Hong Kong persons.

Licence Classes and Capital Requirements

There is one VASP licence class, but it stacks with SFO licensing where the platform trades security tokens. A pure crypto exchange (non-security tokens only) needs the VASP licence alone. A platform trading tokenised securities alongside BTC/ETH needs both the VASP licence and SFO Type 1 (dealing in securities) and/or Type 7 (automated trading services).

Capital thresholds under the SFC's VASP licensing conditions:

• Paid-up share capital: minimum HK$5 million at all times.
• Liquid capital: the higher of HK$3 million or 5% of client assets held on-platform (subject to SFC's prescribed calculation methodology).
• Insurance or compensation arrangement: platforms serving retail clients must maintain insurance covering at least 50% of client virtual assets held in hot wallets, and 1% of assets in cold storage.

Fit-and-Proper and Governance

Every licensed VASP must appoint at least two Responsible Officers (ROs). ROs must pass the SFC's fit-and-proper assessment: relevant industry experience (typically 3+ years in financial services or virtual assets), no criminal convictions, and demonstrated knowledge of AML/CFT obligations. The SFC has been granular here — it rejected several early applicants whose proposed ROs lacked documented compliance experience.

A Licensed Representative (LR) structure mirrors the SFO framework. Individuals conducting regulated VA activities on behalf of the licensee must be approved LRs.

AML/CFT Obligations

This is where AMLO Schedule 2 bites hard. Licensed VASPs must:

• Conduct full CDD on all customers before onboarding, with enhanced due diligence for politically exposed persons and high-risk jurisdictions.
• Apply the Travel Rule: transmit originator and beneficiary information for VA transfers above HK$8,000 (approximately USD 1,000), consistent with FATF Recommendation 16.
• Maintain transaction monitoring systems capable of real-time screening against UN, OFAC, and HKMA sanctions lists.
• File Suspicious Transaction Reports (STRs) with the Joint Financial Intelligence Unit (JFIU) within a reasonable time after suspicion arises — the SFC has indicated "reasonable" means hours, not days, for high-risk flags.
• Retain records for 6 years minimum.

Retail vs. Professional Investor Distinctions

Platforms electing to serve retail clients face a materially heavier compliance load. The SFC's November 2023 circular on retail access requirements mandates:

• Token admission criteria: only tokens with at least 12 months of trading history and inclusion in at least two "acceptable indices" may be offered to retail clients.
• Mandatory suitability assessments before any retail client executes a trade.
• Leverage restrictions: no margin or leveraged products for retail.
• Segregation of client assets: client virtual assets must be held in segregated wallets, with at least 98% in cold storage.

Platforms choosing to restrict to professional investors only avoid the token admission and suitability rules but must implement robust PI verification and cannot accept orders from retail clients under any circumstances.

---

What This Means for Your Company

If you run a centralised exchange with any Hong Kong nexus, the licensing question is binary. There's no regulatory grey zone left. The SFC's 2025 enforcement actions — including public warnings against at least six named platforms and referrals to the police for unlicensed activity — confirm the agency is moving beyond guidance into prosecution mode.

For platforms already in the deemed-to-be-licensed queue (applied before 29 February 2024), the SFC has been processing applications in tranches. Approval timelines have run 12-18 months from submission. During that window, you can continue operating but must comply with all substantive licensing conditions as if licensed. That's not a soft landing — it's full compliance obligations without the licence certificate.

For new entrants post-February 2024, there's no transitional protection. You must obtain the licence before commencing operations. Pre-application engagement with the SFC through its VASP licensing team is strongly recommended; the SFC has published a formal pre-application checklist and expects applicants to have resolved structural issues before formal submission.

Overseas platforms geo-blocking Hong Kong users should audit their controls carefully. The SFC has taken the position that IP-based geo-blocking alone is insufficient if the platform accepts HK-issued payment methods, HK-registered corporate accounts, or HK phone numbers during KYC.

---

How to Operationalize

Step 1 — Corporate structure audit (Weeks 1-4) Confirm the Hong Kong entity that will hold the licence. The SFC requires the licensee to be a company incorporated in Hong Kong or a registered non-Hong Kong company with a substantive local presence. Assess whether your current group structure requires a new HK subsidiary.

Step 2 — Capital adequacy review (Weeks 2-6) Model your liquid capital position against the HK$3 million / 5%-of-client-assets threshold. If you're retail-facing, model the insurance requirement against your hot/cold wallet split. Engage an SFC-recognized auditor early — they'll need to sign off on your opening capital statement.

Step 3 — Appoint and vet Responsible Officers (Weeks 3-8) Identify at least two RO candidates. Compile their CVs, regulatory history, criminal record checks, and reference letters. The SFC's fit-and-proper questionnaire is detailed; incomplete submissions are a leading cause of delay.

Step 4 — AML/CFT programme build-out (Weeks 4-16) Draft or update your AML/CFT policy to AMLO Schedule 2 standards. Implement Travel Rule compliance — select a FATF-compliant Travel Rule solution (several are operational in HK). Configure transaction monitoring with HK-specific typologies. Conduct a gap analysis against the SFC's AML guidelines (latest version: November 2023).

Step 5 — Technology and custody review (Weeks 6-16) Document your wallet architecture. Demonstrate the 98% cold storage requirement if retail-facing. Engage a cybersecurity assessor to produce the penetration testing report the SFC requires as part of the application.

Step 6 — Prepare the application package (Weeks 12-20) The SFC's VASP licence application comprises: Form VA-1 (entity details), Form VA-2 (RO/LR details), business plan, financial projections (3 years), AML/CFT manual, IT security assessment, custody arrangements description, and fee payment (HK$4,740 application fee as of 2025 schedule).

Step 7 — Submit and manage the SFC dialogue (Ongoing) Expect multiple rounds of SFC queries. Assign a dedicated internal point of contact. Response turnaround matters — the SFC has noted that slow applicant responses extend timelines significantly.

Step 8 — Post-licence obligations Once licensed: file monthly returns, notify the SFC within 7 days of any material change (key personnel, ownership, product additions), conduct annual AML audits, and maintain the capital thresholds continuously.

---

Common Mistakes and How to Avoid Them

Underestimating the RO experience bar. The SFC has rejected RO nominations where the candidate's "compliance experience" was primarily in traditional finance with no demonstrable VA-specific knowledge. Solution: pair a senior finance compliance professional with someone who has documented crypto-native experience.

Treating the transitional period as a compliance holiday. Platforms in the deemed-to-be-licensed queue that failed to implement full AML/CFT controls during the transitional period have faced SFC supervisory action. The transitional status is operational permission, not a compliance waiver.

Geo-blocking theatre. Blocking HK IP addresses while accepting HK bank transfers or HK-issued cards during onboarding is not a defence. Audit your entire onboarding funnel, not just the IP layer.

Misclassifying tokens. Listing a token that qualifies as a "security" under the SFO without the corresponding Type 1 licence is a separate criminal offence. Run every listed token through the SFC's token classification framework before listing.

Inadequate Travel Rule implementation. Sending VA transfers without originator/beneficiary data, or using a Travel Rule solution that doesn't interoperate with counterparty VASPs, is a direct AMLO breach. Test your Travel Rule solution end-to-end before go-live.

Skipping the pre-application meeting. The SFC's VASP licensing team offers pre-application engagement. Applicants who skip this step and submit cold applications frequently receive extensive first-round queries that could have been resolved in a 90-minute meeting.

---

FAQ

Q: Can a foreign-incorporated exchange serve Hong Kong retail clients without a local entity? A: No. The SFC's position is that operating a VA exchange in Hong Kong — including marketing to HK residents from overseas — requires a Hong Kong-incorporated or registered entity holding the VASP licence. A Cayman or BVI parent cannot hold the licence directly.

Q: Does the VASP licence cover NFT trading platforms? A: Generally no, if the NFTs are genuinely non-fungible and not marketed as investments. The SFC has indicated that fractionalized NFTs or NFT collections with fungible secondary-market trading characteristics may fall within the "virtual asset" definition. Platforms trading NFTs should obtain a legal opinion on classification before assuming they're outside the regime.

Q: What happens if we're already licensed under the SFO's Type 1 regime for security tokens? A: SFO licensing does not substitute for the VASP licence. If your platform also trades non-security virtual assets (e.g., BTC, ETH), you need both the VASP licence and the relevant SFO licence(s). The SFC has confirmed this dual-licensing requirement explicitly.

Q: How long does the VASP licence application realistically take? A: Based on the SFC's published decisions through early 2026, first-wave applicants with complete submissions have seen 12-18 months from formal submission to decision. Incomplete applications or slow query responses push this to 24+ months. Pre-application engagement and a complete first submission are the most effective timeline levers.

Q: Are decentralised exchanges (DEXs) subject to the VASP licence requirement? A: The SFC has not issued definitive guidance on fully decentralised protocols with no identifiable operator. However, any DEX with a Hong Kong-based team, a legal entity, or a front-end controlled by an identifiable person is likely to be treated as operating a VA exchange. The "no operator" argument is high-risk without a formal no-action position from the SFC.

---

Sources

• Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), Part 5B and Schedules 1-2, Hong Kong Laws
• Securities and Futures Commission, Licensing conditions for licensed virtual asset trading platforms, SFC, November 2023
• Securities and Futures Commission, Circular on regulatory requirements applicable to licensed VATPs for providing services to retail investors, SFC, November 2023
• Financial Action Task Force, Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers, FATF, 2021

---

Disclaimer

This article is produced by BizLegal-AI Intelligence Desk for general informational purposes only. It does not constitute legal advice and does not create a solicitor-client or attorney-client relationship. Regulatory requirements change frequently; verify all information against current official sources before relying on it. Consult qualified legal counsel in Hong Kong for advice specific to your circumstances.