Hong Kong VASP License: SFC Application Requirements and Process

Hong Kong’s Mandatory VASP Regime

The Securities and Futures Commission (SFC) launched mandatory licensing for Virtual Asset Trading Platforms (VATPs) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) on 1 June 2023. From that date, any person operating a virtual asset trading platform (VATP) in Hong Kong, or actively marketing to Hong Kong investors, is required to be licensed by the SFC.

The regime replaced the SFC’s earlier opt-in framework (under which only platforms that chose to trade security tokens were regulated). The 2023 mandatory regime applies to all VATPs, including those trading purely non-security virtual assets, regardless of whether those assets constitute securities under Hong Kong law.

Hong Kong’s pivot to a mandatory licensing regime signals a policy decision to position the HKSAR as a regulated, institutionally credible virtual asset hub following the collapse of several unregulated platforms. The SFC’s stated policy objective is to bring virtual asset trading within a regulatory framework comparable to traditional securities trading.

Who Must Be Licensed

The licensing obligation applies to:

• Any person operating a VATP in Hong Kong
• Any person that, while not physically operating in Hong Kong, actively markets a VATP to Hong Kong investors

“Operating a VATP” means providing a trading platform service — which includes order matching, order book operation, and any other mechanism through which buyers and sellers of virtual assets are connected for the purpose of executing transactions.

VATPs that only provide services to professional investors (as defined under the Securities and Futures Ordinance — broadly, entities with a portfolio of HKD 8 million or more) continue to operate under the SFC’s pre-existing framework for security tokens. However, all VATPs must now be licensed regardless of whether they restrict services to professional investors.

Who is exempt: Peer-to-peer trading platforms that merely facilitate introductions between buyers and sellers without operating an order book or matching engine are not considered to be operating a VATP and are not required to be licensed. The SFC has made clear, however, that this exemption is narrow and should not be interpreted to cover any platform that plays an active role in the trading process.

The VASP License: Key Requirements

Minimum Liquid Capital: HKD 5,000,000

VATPs must maintain minimum liquid capital of HKD 5,000,000 at all times. Liquid capital for this purpose means current assets minus current liabilities, with certain deductions applied (similar to the securities firm capital computations under the Securities and Futures (Financial Resources) Rules).

In addition, VATPs must maintain a buffer above the minimum — they must notify the SFC if their liquid capital falls to within 120% of the minimum (i.e., below HKD 6,000,000). This notification triggers regulatory engagement and a requirement to submit a remediation plan.

Responsible Officers

Every licensed VATP must appoint at least two responsible officers (ROs) for each regulated activity it conducts. Responsible officers are individuals approved by the SFC who take personal accountability for ensuring the VATP’s compliance with applicable requirements.

RO requirements:

• Minimum one RO must be an executive director or equivalent who is actively involved in day-to-day management of the regulated activity
• ROs must satisfy the SFC’s fit and proper requirements: good character, competence, sound financial standing
• ROs must have relevant knowledge and experience — for VATPs, this means experience in virtual asset trading, blockchain technology, financial markets, or compliance in a directly relevant role
• At least one RO must be ordinarily resident in Hong Kong

The RO framework is one of the most demanding aspects of the VASP regime. Finding individuals who meet the SFC’s standards and are willing to take personal responsibility for VATP compliance is a material operational challenge.

AML/CFT Obligations

VATPs must comply with the AMLO’s AML/CFT requirements, as elaborated in the SFC’s licensing conditions and the SFC’s AML/CFT guidelines for VATPs.

Key requirements:

• CDD: Identity verification for all customers before services are provided. Enhanced CDD for higher-risk customers, PEPs, and customers from high-risk jurisdictions.
• Transaction monitoring: Automated monitoring of all virtual asset transactions for suspicious patterns. Blockchain analytics tools required for on-chain monitoring.
• VASP-to-VASP transfers (Travel Rule): Hong Kong implemented FATF R.16 for virtual asset transfers. For transfers between VASPs above HKD 8,000, originator and beneficiary information must be collected and transmitted.
• Suspicious Transaction Reporting: SARs must be filed with the Joint Financial Intelligence Unit (JFIU) promptly upon reasonable grounds for suspicion.
• Sanctions Screening: All customers and counterparties must be screened against applicable sanctions lists, including UN, US OFAC, EU, and HK Financial Sanctions lists.

Tokenization-Specific Requirements per SFC Circulars

The SFC has issued several circulars addressing the specific compliance requirements for tokenized securities traded on or through VATPs.

The SFC’s position on tokenized securities is that a tokenized security is a security for all SFC regulatory purposes — the token is the wrapper, but the underlying rights and obligations are those of the security. Accordingly, VATPs that trade tokenized securities must comply with both VASP-specific requirements and the applicable securities regulatory framework under the Securities and Futures Ordinance.

Key SFC guidance on tokenization (as at Q1 2026):

• VATPs trading tokenized funds must verify that the underlying funds are properly authorized or recognized by the SFC
• VATPs trading tokenized bonds must ensure prospectus requirements have been complied with
• Smart contract code underlying tokenized securities must be audited by an independent firm acceptable to the SFC
• Custody arrangements for tokenized securities must meet the SFC’s requirements for client asset custody

The SFC has published detailed guidance on tokenized SFC-authorized investment products, reflecting Hong Kong’s ambition to become a hub for institutional tokenized fund distribution.

Application Process

Pre-Application Preparation

Unlike the MAS, which has an online application portal with structured submission requirements, the SFC’s VASP application process requires advance preparation meetings. Applicants are expected to engage with the SFC’s VATP licensing team before submitting a formal application. This pre-application engagement allows the SFC to identify major gaps in a firm’s readiness before a formal application is lodged.

Application Submission

The VASP license application is submitted to the SFC’s Licensing Department. The application fee is HKD 50,000 (non-refundable).

Required documentation includes:

• Corporate information: certificate of incorporation, articles of association, group structure, UBO chart
• Business plan: services to be offered, technology infrastructure, trading platform architecture
• Capital adequacy: evidence of liquid capital exceeding HKD 5 million
• Management information: CVs and personal questionnaires for all RO nominees and senior management
• AML/CFT policies and procedures
• IT security documentation: penetration testing, key management, cold storage procedures
• Custody arrangements: how client virtual assets will be held, segregated, and safeguarded
• Insurance: professional indemnity and crime insurance coverage

Review Timeline

The SFC does not publish a fixed review timeline. Based on industry experience, VATPs with complete, well-prepared applications have received decisions in 9–14 months. Applications with deficiencies have extended beyond 18 months.

The SFC conducts on-site inspections of applicants during the review process. These inspections assess operational readiness, not merely documentation adequacy.

Custody Requirements: The 98% Cold Storage Rule

The SFC requires VATPs to hold at least 98% of client virtual assets in cold storage (hardware devices or cold storage systems not connected to the internet). A maximum of 2% may be held in hot wallets (internet-connected storage) for operational liquidity purposes.

This 98% cold storage requirement is the most demanding custody standard of any major jurisdiction globally. It reflects the SFC’s assessment that exchange-held hot wallets represent the dominant attack vector in exchange hacks.

Cold storage arrangements must:

• Use hardware security modules (HSMs) or equivalent air-gapped hardware
• Implement multi-signature or multi-party computation (MPC) key management
• Distribute key shards geographically across at least three locations
• Be tested for recovery capability at least annually

The 2% in hot wallets must be covered by insurance against cyber theft. The SFC has not specified a minimum coverage amount, but expects the insurance to be commensurate with the value of assets in hot storage.

Related Resources

• Licensing Cost and Timeline Comparison
• AML Framework for Tokenization Platforms
• Travel Rule Compliance Guide
• Jurisdictions Database: Hong Kong
• Regulatory Benchmarks