Why Choose Hong Kong for Crypto Licensing?
Hong Kong combines a tier-1 global financial centre with a fully operational virtual-asset licensing regime supervised by the Securities and Futures Commission. The SFC’s list shows 13 licensed Virtual Asset Trading Platforms (read ; the latest licensed on 18 May 2026), the HKMA has licensed two stablecoin issuers, and Policy Statement 2.0 () signalled further expansion through the LEAP framework. The trade-off is cost and timeline: Hong Kong is slower than Singapore or the UAE, and its entry-level spend runs well above the UAE’s.
Hong Kong’s appeal for crypto businesses sits on five pillars:
- Tier-1 financial centre status: HKD/USD fiat rails, a deep institutional investor base, and proximity to mainland China and Greater Bay Area capital.
- A substantive operational regime: 13 SFC-licensed VATPs on the SFC’s list as of , 11 of them licensed since October 2024, and the first two stablecoin issuers licensed under Cap 656.[1][2]
- Retail access: permitted for “eligible large-cap” virtual assets, an option Singapore has actively discouraged.[3]
- A deliberate tokenisation push: under Policy Statement 2.0’s LEAP framework, with stamp-duty exemption for tokenised ETFs and a proposed profits-tax exemption for “specified digital assets” in qualifying funds.[4]
- An attractive tax base: 8.25% / 16.5% two-tier profits tax, no capital gains, no VAT, territorial source basis.[5]
For operators targeting Asia-Pacific institutional flow, Hong Kong is the natural Asian counterpart to a European MiCA CASP licence: substantive supervision, branded credibility for banking introductions, and clear forward roadmap. In practice, banking introductions move materially faster for SFC-licensed VATPs than for unlicensed crypto operators. The HKMA’s Access to Banking Services for Corporate Customers circular of has structurally shifted bank risk appetite where regulated counterparties are concerned.[6] What the regime is not is a passport.
A Hong Kong licence does not authorise services into the European Union, the United Kingdom, or the United States, and operators with material EU demand need a parallel CASP authorisation in an EU member state.
The most compelling reason to choose Hong Kong over Singapore or Dubai is the combination of substantive retail access and tier-1 banking infrastructure under one regulatory roof. The real constraint is the 12-to-18-month timeline and the HKD 6.35–17.2 million first-year build. Neither is negotiable, and applicants who underestimate either tend to stall mid-process.
Regulatory Framework
Hong Kong’s virtual-asset framework rests on three primary ordinances (the SFO, the AMLO and the Stablecoins Ordinance) plus subordinate guidelines from two regulators. The Securities and Futures Ordinance (SFO, Cap 571) provides the licensing architecture for Type 1 and Type 7 regulated activities applicable to VATPs that trade security tokens. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap 615), as amended by the AMLO (Amendment) Ordinance 2022, added Part 5B creating the dedicated VASP licensing regime, operative since .[7] The Stablecoins Ordinance (Cap 656) commenced and regulates fiat-referenced stablecoin issuance under the HKMA.[8]
Definition: Virtual Asset Trading Platform (VATP) Licence
An SFC-issued authorisation to operate a centralised virtual-asset trading platform in Hong Kong. The licence is granted under the Securities and Futures Ordinance (Cap 571) for Type 1 (dealing in securities) and Type 7 (providing automated trading services) regulated activities together with the AMLO Part 5B VASP licence: most platforms hold both because tokens may be classified as securities or non-securities and the classification can evolve. Hong Kong applies the two-tier profits tax (8.25% / 16.5%) on licensee operating profits; capital gains are not taxed.
Regulatory History
Hong Kong’s first crypto licensing framework was a voluntary opt-in regime launched by the SFC in for platforms trading security tokens, which proved too narrow. The Legislative Council passed the AMLO Amendment Ordinance in to create the mandatory VATP regime under AMLO Part 5B, effective .[7] A 12-month transitional period, to , let platforms already operating in Hong Kong continue; those that applied by became deemed-to-be-licensed applicants from until the SFC decides their applications (AMLO Schedule 3G).[2]
Several large international exchanges left the process before the transitional period ended: the applications of OKX, Gate.HK, Huobi HK and Bybit’s first applicant were withdrawn and Meex’s was returned. Crypto.com’s Hong Kong applicant remains on the SFC’s list of deemed-to-be-licensed applicants, and Bybit applied again in June 2025.[2] New platforms have been licensed since October 2024.
Parallel to the VATP work, the HKMA published a discussion paper on cryptoassets in and ran a public consultation in on the stablecoin regime. The Stablecoins Bill passed LegCo on , was gazetted , and commenced by Commencement Notice gazetted .[9] The HKMA received 36 stablecoin licensing applications by the deadline and granted the first two licences on .[1][31]
Recent Regulatory Developments
- : SFC required internet brokers and VATPs to stop using one-time passwords for client login and device binding and to adopt phishing-resistant authentication within 12 months.[34]
- : SFC circular on HKMA-licensed (“Relevant”) stablecoins: no index or liquidity test for retail trading, no virtual-asset knowledge assessment for stablecoin-only clients, and holdings excluded from the client exposure limit.[33]
- : SFC framework piloting secondary trading of tokenised SFC-authorised funds, initially money market funds, on licensed VATPs.[34]
- : HKMA granted the first two stablecoin issuer licences under Cap 656: Anchorpoint Financial Limited (FRS01) and The Hongkong and Shanghai Banking Corporation Limited (FRS02).[1]
- : SFC released the High-Level Framework for Virtual Asset Perpetual Contracts Offering by Virtual Asset Trading Platforms, opening perpetual contracts to professional investors only, on virtual assets available for retail spot trading on the platform or an IOSCO-compliant index of them, with margining designed so that the platform carries no credit exposure; the same day it let affiliates of licensed VATPs act as market makers.[10][34]
- : SFC issued the Shared Order Book circular permitting VATPs to integrate operationally with affiliated overseas VATPs subject to prior approval, plus the Expanded Products and Services circular broadening distribution and custody scope.[11]
- : HKSAR Government published Policy Statement 2.0 on the Development of Digital Assets, introducing the LEAP framework (Legal streamlining, Expanding tokenisation, Advancing use cases, People and partnership).[4]
- : SFC Circular 25EC22 on staking services lifted the previous prohibition, permitting VATPs to offer staking with prior written SFC approval.[12]
- : SFC published the ASPIRe Roadmap (Access, Safeguards, Products, Infrastructure, Relationships): 12 initiatives across five pillars guiding virtual-asset policy through 2027.[13]
Regulatory Overlap
Four overlapping regimes operate alongside the core SFC VATP licence:
- HKMA Stablecoin Issuer (Cap 656). Trigger: issuance of fiat-referenced stablecoins in Hong Kong, or referencing HKD anywhere. Consequence: separate paid-up capital of HKD 25 million and HKMA prudential supervision in addition to (or instead of) SFC VATP licensing.[8]
- C&ED Money Service Operator licence (AMLO Cap 615 Part 5). Trigger: fiat money-changing or remittance, which many crypto OTC desks provide alongside their crypto business. Consequence: separate fit-and-proper assessment by Customs and Excise. The licence does not authorise virtual-asset dealing itself, which the proposed VA dealing regime will cover once it commences.[14]
- SFC Type 9 (Asset Management) with virtual-asset conditions. Type 9 covers management of securities or futures portfolios. For a Type 9 manager, a stated virtual-asset investment objective or allocation of ≥10% of gross asset value triggers the additional Virtual Asset Fund Management Terms and Conditions.[15][39]
- Proposed SFC VA Dealing and VA Custodian licences. Trigger: OTC trading or third-party VA custody outside an SFC-licensed VATP. Consequence: consultation conclusions published December 2025; the Government targets one bill covering the dealing, custodian, advisory and management regimes within 2026. No deeming arrangement: each regime takes full effect on a commencement date still to be set.[16]
License Types and Activities Covered
Choose the licence by activity. Centralised trading platforms use the SFC VATP route; fiat-referenced stablecoin issuers use the HKMA route. An MSO licence does not substitute for either. Fund managers must first assess whether their portfolios involve securities or futures: virtual-asset exposure alone does not automatically require Type 9.[39]
Covered Activities
- SFC Virtual Asset Trading Platform (VATP): primary regime. Centralised order-book or quote-driven trading of virtual assets between users, where the platform takes custody of client virtual assets. The licence captures both security-token activity (Type 1 + Type 7 under the Securities and Futures Ordinance) and non-security activity (AMLO Part 5B VASP licence). Dual licensing is the SFC’s strong preference because token classification can evolve.[17]
- HKMA Stablecoin Issuer Licence. Issuance in Hong Kong of a specified stablecoin, one purporting to keep a stable value by reference wholly to one or more official currencies (or another unit the HKMA specifies), plus issuance outside Hong Kong of a specified stablecoin referenced wholly or partly to the Hong Kong dollar. A basket mixing a fiat currency with other assets is not captured merely because one component is fiat; it needs its own classification. An in-scope design stays regulated even if it cannot meet the full-reserve licensing conditions: under-collateralisation is not an exemption, and an algorithmic or under-backed design cannot be licensed.[8]
- C&ED Money Service Operator (MSO) Licence. Fiat money-changing and remittance. Crypto OTC desks often hold one for the fiat services they also provide, but Customs has stated that an MSO licence does not approve or recognise a virtual-asset business. Two-year initial licence, no minimum capital. Issued by the Customs and Excise Department Money Service Supervision Bureau. Virtual-asset dealing itself will fall under the proposed SFC VA dealing regime once it commences.[14]
- Virtual-asset fund management. Managing only a portfolio of virtual assets that are neither securities nor futures does not itself require Type 9 under the current SFO regime. Distributing that fund in Hong Kong can require Type 1 because the fund interests are securities. The proposed standalone VA management regime is a separate reform, not an existing Type 9 requirement.[39][16]
What Does NOT Require Registration
- Pure peer-to-peer wallet software without custody, matching, or order-routing functionality. The VATP regime requires platform operation; non-custodial software-only providers fall outside.[17]
- Tokenised securities trading. Trading of tokens that legally constitute securities is regulated under the Securities and Futures Ordinance Type 1 and Type 7 regulated activities, not under AMLO Part 5B. The SFC permits VATPs and traditional brokers to trade tokenised securities subject to the standard SFO conditions.[15]
- NFTs that are pure collectibles. Where an NFT functions as a digital collectible without investment characteristics and no security-token features, it is generally outside the VATP perimeter. NFTs marketed as fractional investments fall within the SFC’s collective investment scheme analysis.[17]
- Bank-provided digital-asset services to existing customers under the SFC–HKMA Joint Circular 25EC50 (). Authorised Institutions distributing or providing custody for VA-related products to qualifying clients operate under bank-side supervision rather than a standalone VATP licence.[15]
Activity Restrictions
Retail-eligible tokens. Apart from Relevant Stablecoins, retail clients on SFC-licensed VATPs are limited to “eligible large-cap virtual assets”: tokens included in at least two acceptable indices from independent providers, with at least one index meeting IOSCO standards.[3] The historical 12-month track-record requirement was removed for professional-investor-only access in the November 2025 Products and Services circular, and stablecoins of HKMA-licensed issuers are exempt from it; it remains for other retail tokens.[32]
Derivatives. Currently prohibited for retail. The SFC perpetual contracts framework permits perpetuals for professional investors only, referencing virtual assets available for retail spot trading on the platform, with margining designed so that the platform carries no credit exposure to participants.[10]
Stablecoins for retail. Retail access to stablecoins on VATPs is restricted to HKMA-licensed stablecoin issuers. The HKMA register still lists only the two issuers licensed on 10 April 2026 (read ), so only their stablecoins may be offered to retail; others may be offered to professional investors only.[1][9] An SFC circular of exempts these licensed-issuer stablecoins from the index and liquidity tests for retail tokens and from the client exposure limit.[33]
Tokenised securities and RWA
Hong Kong treats a tokenised security as a traditional security carried on a distributed ledger, not as a new asset class. The tokenisation wrapper does not change the regulatory character of the underlying instrument, so the Securities and Futures Ordinance (Cap 571) and the prospectus regime apply in full, on a see-through basis. The SFC set this position in its two circulars of , one on intermediaries in tokenised-securities activities and one on tokenisation of SFC-authorised investment products, which superseded its earlier March 2019 “complex product” treatment; the HKMA issued a companion circular on tokenised products on . The practical consequence is that a tokenised bond, note or fund interest is dealt with under the same SFO obligations as its conventional equivalent.
This matters for licence scope. An AMLO-only VATP licence covers non-security tokens and does not itself authorise securities services. The dual SFO/AMLO VATP route includes Type 1 and Type 7 permissions for trading security tokens, with related custody, subject to licence, product and listing conditions. Issuance and public-offer approvals, and advising (Type 4) or asset-management (Type 9) permissions, are assessed separately.
We scope the securities-token route through the SFO permissions, and where the underlying instrument is a fund interest we scope it through the fund licensing route, pairing either with VATP custody or trading permissions only where the operating model needs them.
Requirements
Hong Kong’s VATP requirements split across five layers: capital, substance, governance, custody, and AML/CFT. Each layer carries independent fit-and-proper tests. The combined effect is a prescriptive regime: the cold-storage ratio, the associated-entity custody model and the compensation cover are fixed in the VATP Guidelines rather than left to a firm’s own risk assessment.
| Requirement | Threshold |
|---|---|
| Paid-up share capital (VATP) | HKD 5 million minimum≈ $640K |
| Required liquid capital (VATP) | Higher of HKD 3 million and the basic amount under the Financial Resources Rules≈ $380K fixed floor |
| Liquid asset cushion | ≥12 months of operating expenses, virtual assets excluded |
| Paid-up share capital (HKMA Stablecoin Issuer) | HKD 25 million minimum (AIs exempt)≈ $3.2M |
| Reserve backing (Stablecoin) | 100% in HQLA, segregated under trust, monthly attestation |
| Responsible Officers (ROs) | ≥2 licensed ROs, ≥1 ordinarily resident in Hong Kong, ≥1 a director |
| Local incorporation | HK-incorporated, or non-HK company registered under Cap 622 Part 16 |
| Principal place of business | Hong Kong, with HK record-keeping premises |
| Cold storage ratio | ≥98% of client virtual assets in cold storage |
| Custody model | Wholly-owned Associated Entity with TCSP licence |
| Compensation arrangement | 50% of cold-storage client VAs + 100% of hot/other |
| Min. Directors | 1 under company law; ≥1 executive director approved as a Responsible Officer; no independent-director requirement |
| Foreign Ownership | No restriction; UBO disclosure and fit-and-proper applies |
| Professional Indemnity Insurance | Risk-based per SFC FRR; typically required as part of compensation arrangement |
Fit-and-Proper Assessment
The SFC’s Fit and Proper Guidelines apply to every director, Responsible Officer, Licensed Representative (LR), Manager-in-Charge of a Core Function (MIC), and ultimate beneficial owner. The assessment examines six dimensions: financial status and solvency, educational and professional qualifications, ability to perform regulated activities competently, honestly and fairly, reputation, character, reliability, and financial integrity, fitness of associates and connected persons, and any disciplinary record with overseas regulators.[18] The common mistake is treating the RO licensing as a formality. The SFC actively reviews CPT records, prior employment with regulated firms, and the proposed individual’s substantive role at the applicant, not just paper qualifications.
Local Presence
Hong Kong VATPs must operate from a permanent place of business in Hong Kong with records held locally. The SFC normally approves only HK premises for record-keeping under §130 of the Securities and Futures Ordinance. At least one Responsible Officer should ordinarily reside in Hong Kong to supervise the business;[21] in practice, a sole HK-resident RO who has just relocated, without Hong Kong regulated-firm experience, draws close questioning. Experienced applicants budget for a HKD 800,000 to HKD 1.5 million annual office and substance line item from year one. Bare-shell arrangements rarely survive the SFC’s on-site inspection under the swift licensing process.
AML/CFT and Travel Rule
VATPs are subject to the AMLO Schedule 2 customer due diligence regime plus the SFC’s Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers) dated . Customer due diligence includes beneficial-owner look-through to natural persons. Ongoing monitoring is risk-based. Suspicious transaction reports go to the Joint Financial Intelligence Unit (JFIU) of the Hong Kong Police Force.[19]
The Travel Rule (FATF Recommendation 16) applies to every transfer regardless of value, with tiered information requirements at the HKD 8,000 (approximately USD 1,000) threshold under SFC AML/CFT Guideline Chapter 12: above HKD 8,000 full originator information (address, identification number or document number, or date and place of birth) must be obtained, held, and submitted; below the threshold, originator and beneficiary name and account number are required.
Unhosted (self-hosted) wallet transfers require verification of customer ownership or control through micro-payment tests, message-signing tests, or supporting evidence; sole reliance on customer self-declaration is not acceptable per the SFC’s FAQ Q29.[19]
Application Process
The VATP Licensing Handbook sets no fixed processing period: scope, control readiness, application quality, and regulatory queries determine the review time.[21] The general corporate-licensing estimate of 15 weeks is not a VATP approval deadline.[20] Under the SFC’s swift licensing process (introduced for all new VATP applicants submitting after ), the substantive end-to-end process runs 12 to 18 months from start of meaningful preparatory work and covers pre-application engagement, written submissions, SFC on-site inspection, and direct engagement, implementation of policies and systems, a single external assessment under HKSAE 3000 / ISAE 3000 tripartite framework with independent penetration test, and full grant.
Application language: English. Submissions go through the SFC’s online WINGS portal as a single consolidated SFO (Type 1 + 7) plus AMLO VASP application.
Pre-application engagement: The SFC’s Fintech Contact Point and dedicated VATP team accept early engagement meetings before formal submission. Use these. Early signalling on structure, custody design, and token-admission methodology surfaces SFC concerns at a stage where they can still be addressed without rework.
Hong Kong Incorporation and Structure
Forming a Hong Kong entity is the first step. See the Hong Kong company formation guide for entity selection (limited company under Cap 622), the company secretary, registered office, and business registration. The Associated Entity (wholly-owned subsidiary for custody with a TCSP licence) is incorporated in parallel.
Substance and Responsible Officers
RO competence preparation including continuing professional training, Regulatory Industry Qualification examinations where applicable, and CV documentation. HK-resident RO recruitment if the founding team lacks one. Office lease, IT infrastructure procurement, and bank account opening (covered in the Banking section of the formation guide).
Written Submissions
Business plan, organisational chart, three-year financial projections, technology architecture documentation, custody design including HSM specifications and key-management procedures, AML/CFT policy and procedures manual, conflicts-of-interest policy, code of ethics, risk-management framework, market-surveillance design, and token-admission methodology. The common mistake is treating these as a template exercise. The SFC reads them as primary evidence of governance maturity.
SFC On-Site Inspection and Direct Engagement
Under the swift licensing process, the SFC engages directly with applicants through on-site inspections of premises, systems, and controls before the external assessment. SFC engagement covers structure, governance, operations, systems, controls, token admission, custody, KYC, AML/CFT, market surveillance, risk management, and cybersecurity. The applicant’s WINGS submission package, including external assessor details, is reviewed during this stage.
SFC Review and Rectification
Written feedback rounds, RO, and MIC interviews, structural questions on shareholders or affiliated parties, rectification plan, approval-in-principle. The VATP handbook gives no fixed review clock; the calendar depends on the application and the responses to regulatory queries.[21]
Single External Assessment and Grant
Once policies, procedures, systems, and controls have been implemented, the external assessor conducts a single external assessment under HKSAE 3000 / ISAE 3000 via a tripartite agreement between the applicant, the external assessor, and the SFC. The assessment covers both design and implementation effectiveness, including an independent penetration test and vulnerability assessment of the live production environment. Satisfactory results must be filed before the SFC grants full licence.
Hong Kong-specific AML/CFT policies, custody procedures and market-surveillance design are drafted within the licensing engagement by the independent specialist introduced for the case, who also coordinates the single external assessment under the HKSAE 3000 tripartite framework. The compliance documentation is the most time-intensive component of any Hong Kong VATP application: typically 14 to 22 weeks of specialist work that cannot be shortcut with generic templates. Book a Licensing Assessment →
Required Documents
The SFC’s Licensing Handbook for Virtual Asset Trading Platform Operators ( edition) catalogues the documentation expected at filing.[21] The corporate, personal, compliance, and operational documents below are the substantive minimum; case-specific adjustments are common.
Corporate Documents
- Certificate of Incorporation (Cap 622) and Business Registration Certificate for the applicant and Associated Entity.
- Articles of Association and any shareholders’ agreements.
- Corporate organisational chart showing all entities to ultimate beneficial owners (≥10%).
- Group structure chart with control percentages and operational interlinks.
- Audited financial statements for the applicant and group (or audited opening balance sheet for newly incorporated entities).
- Bank certificate evidencing paid-up share capital.
Personal Documents (All Directors, ROs, LRs, MICs, UBOs)
- Passport / HKID; proof of residential address dated within three months.
- Curriculum vitae with continuous employment record (no gaps over 12 weeks).
- Reference letters from prior regulated employers.
- Educational and professional qualifications.
- Police clearance certificates from each jurisdiction of residence over the past five years.
- Self-disclosure on disciplinary history with overseas regulators.
- Financial standing statement and recent personal bank statements.
Compliance Documentation
The SFC expects bespoke, Hong Kong-specific policy documents: generic templates fail under the single external assessment. They are drafted within the licensing engagement by the independent specialist introduced for the case, tailored to the applicant’s business model, jurisdictional footprint, and risk profile.
Risk-based CDD framework, enhanced due diligence triggers, source-of-funds, and source-of-wealth methodology, ongoing monitoring, screening against UN/HKMA/OFAC sanctions lists, Travel Rule implementation including unhosted-wallet handling, suspicious transaction reporting protocol to the JFIU.
Methodology for evaluating new tokens including legal classification analysis (security vs non-security), regulatory due diligence, market integrity assessment, technical security review, index eligibility verification for retail-track tokens, Token Admission and Review Committee terms of reference.
Associated Entity structure, hot/cold wallet segregation methodology, HSM specifications, and key-generation ceremony, multi-signature thresholds, geographic key distribution, backup and recovery procedures, customer asset segregation, compensation arrangement structure.
Proprietary trading restrictions, market-making policy, related-party transactions, employee personal account dealing rules, information barriers.
Manipulation typologies covered, surveillance system specification, alert escalation, manual review thresholds, regulatory reporting protocol.
Risk taxonomy, three-lines-of-defence model, risk appetite statement, key risk indicators, escalation matrix.
Aligned with SFC VATP Guidelines Part XII and HKMA TM-G-1 / CYB-1 where applicable, including SDLC controls, change management, access controls, incident response, penetration testing programme, third-party risk management.
RTO and RPO targets, alternate site arrangements, communications protocol, annual testing requirements.
Covered persons, pre-clearance, prohibited trading windows, reporting obligations.
Business Plan and Financial Projections
Three-year revenue model with assumptions on user base, trading volume, fee structure, and operating costs. Sensitivity analysis on adverse scenarios (market crash, regulatory tightening, key staff departure). Capital adequacy projections evidencing the 12-month operating-expense liquid asset cushion at each year-end.
Technology and Operational Documentation
Technology architecture diagram covering trading engine, matching, settlement, custody integration, surveillance, KYC/AML systems, and reporting. Network diagram with security zones and access controls. Vendor list with criticality classification. Operational procedures for trading-day operations, end-of-day reconciliation, customer onboarding, deposit and withdrawal processing.
Costs and Pricing
The SFC’s fee schedule under the Securities and Futures (Fees) Rules and AMLO’s Schedule covers application and annual fees.[22] For a dual-regime platform with two responsible officers that comes to HKD 42,660–53,400 in Year 1 and the same again every year, and it is the only part of the bill published in advance. The dominant cost components sit in the build: legal counsel, external assessors, insurance or compensation arrangement, and Hong Kong substance.
Financial resources sit outside the spend: HKD 5 million paid-up share capital and a separate required-liquid-capital test equal to the higher of HKD 3 million and the basic amount.[17]
Government / Regulator Fees (HKD)
| Fee | Note | Amount (HKD) |
|---|---|---|
| SFC and AMLO application fees | ~4,740 per regulated activity: Type 1, Type 7 and the AMLO VA service together for a dual-regime platform | 14,220≈ $1,800 |
| Responsible-officer approvals | ~2,950 per officer per activity, on top of the representative fee. The SFC requires at least two officers; two officers across three activities | 17,700≈ $2,300 |
| Licensed-representative applications | ~1,790 per person per activity. Every responsible officer pays this as well: only a licensed representative may be approved as one | 10,740≈ $1,400 |
| Further licensed representatives | ~1,790 per additional person per activity; two extra representatives across three activities is the upper figure used here | Up to 10,740≈ $1,400 |
| Statutory cost, Year 1 | Application and approval fees for a dual-regime platform with two responsible officers; annual fees first fall due on the licence anniversary | 42,660–53,400≈ $5,400–6,800 |
| Annual fee, platform operator | ~4,740 per regulated activity, recurring from the licence anniversary | 14,220/year≈ $1,800 |
| Annual fee, responsible officers | ~4,740 per officer per activity, recurring. An officer pays 2,950 once for approval and 4,740 every year | 28,440/year≈ $3,600 |
| Annual fee, further licensed representatives | ~1,790 per person per activity, recurring | Up to 10,740/year≈ $1,400 |
| Statutory cost, Year 2 onward (annual) | Annual fees only (the three rows above). The total matches Year 1 because an officer’s annual fee (4,740) equals the one-time approval and representative fees combined (2,950 + 1,790) | 42,660–53,400/year≈ $5,400–6,800 |
| HKMA Stablecoin Issuer licence fee | Separate stablecoin route; payable within 14 days after the licence takes effect, under Cap 656 section 22 and Schedule 3[38] | 113,020 |
| HKMA annual licence fee | Payable on or before each anniversary of the effective date; excluded from the VATP totals above[38] | 113,020/year |
Total Cost Summary (HKD, first year)
| Line Item | Cost (HKD) |
|---|---|
| Hong Kong company formation (applicant + Associated Entity) | 50,000–100,000≈ $6,400–13K |
| Legal and regulatory counsel (application) | 1,500,000–3,000,000≈ $190K–380K |
| Compliance documentation (AML manual, token admission, custody procedures, conflicts, market surveillance, cybersecurity, BCP) | 800,000–1,500,000≈ $100K–190K |
| External assessor (single tripartite assessment under HKSAE 3000) | 500,000–1,500,000≈ $64K–190K |
| Independent penetration test + vulnerability assessment | 300,000–800,000≈ $38K–100K |
| Compensation arrangement (insurance premium or bank-guarantee cost) | 1,000,000–5,000,000≈ $130K–640K |
| Hong Kong office and substance | 800,000–1,500,000≈ $100K–190K |
| Technology stack (custody HSM, surveillance, Travel Rule) | 1,000,000–3,000,000≈ $130K–380K |
| Audit, accounting, tax | 300,000–600,000≈ $38K–76K |
| Local representative / agent | 100,000–200,000≈ $13K–25K |
| Typical build, Year 1 (sum of the lines above, quoted per case) | 6,350,000–17,200,000≈ $810K–2.2M |
| Paid-up share capital (locked in, not a fee) | 5,000,000≈ $640K |
| Required liquid capital (separate test, not a fee) | Higher of 3,000,000 and the basic amount≈ $380K fixed floor |
| Compensation arrangement (insurance premium or bank-guarantee cost) | 1,000,000–5,000,000/year≈ $130K–640K |
| Hong Kong office and substance | 800,000–1,500,000/year≈ $100K–190K |
| Compliance officer and AML team | 1,500,000–3,000,000/year≈ $190K–380K |
| Audit, accounting, tax and platform maintenance | 300,000–600,000/year≈ $38K–76K |
| Typical ongoing build, Year 2 onward (sum of the four lines above, quoted per case) | 3,600,000–10,100,000/year≈ $460K–1.3M |
For the HKMA Stablecoin Issuer regime, expect HKD 25 million paid-up capital plus HKD 12–25 million Year 1 operating spend on top of (or in place of) the VATP stack. Experienced applicants plan against the full HKD 6.35 to 17.2 million Year 1 build range rather than its low end. Applicants who scope at the low end tend to stall at the external assessment stage when budget rework forces parallel renegotiation with insurance providers and external counsel.
The compensation arrangement is the single most volatile line item. The SFC’s standard is 50% of cold-storage client VAs plus 100% of hot/other, reduced from the originally consulted 95% standard in the final May 2023 conclusions.[23] Acceptable assets are third-party insurance, bank guarantees, demand or time deposits maturing within six months, or reserve VAs of the same type in cold storage by the Associated Entity.
Market-rate insurance premiums vary with platform AUC, custody design, and historical incident record. Operators with HKD 1 billion+ AUC typically face seven-figure annual premiums even with a clean track record.
Timeline
| Stage | Duration | Elapsed |
|---|---|---|
| Hong Kong incorporation + Associated Entity | 1–3 months | 1–3 months |
| Substance, ROs, office, banking | 2–4 months | 2–4 months |
| Written submissions and SFC on-site inspection | 3–6 months | 3–9 months |
| SFC review, on-site inspection, rectification, AIP | 6–9 months | 8–14 months |
| Single external assessment (HKSAE 3000), penetration test, full grant | 2–4 months | 12–18 months |
| Total (substantive engagement to grant) | 12–18 months typical; 24+ months for complex applicants |
Stages overlap rather than run end to end, so the Elapsed column gives the month window in which each stage closes, matching the six process stages above, with Stages 3 and 4 combined in one row.
Singapore cannot be treated as the faster alternative: MAS warns of a wait of more than a year before a review officer is available, with review and grant conditions still to follow. See the Singapore timeline. Dubai’s VARA planning range is 6 to 12 months for simpler activities and 12 months or longer for an Exchange. As of the SFC’s list shows 13 licensed VATPs: two licensed before the regime became mandatory and 11 since October 2024, fewer than five new licences a year since 1 June 2023.[2] On our reading, the pace reflects the depth of the single external assessment under HKSAE 3000 / ISAE 3000 more than SFC capacity. The HKMA Stablecoin track is slower still: 36 applications, two licences granted on , with HKMA Chief Executive Eddie Yue signalling that the overall number of licences “will remain very limited”.[31]
Applicants targeting Year 1 trading should plan substantive engagement to begin at least 18 months before the intended go-live date.
Taxation
Hong Kong is a low-tax, territorial-source jurisdiction, but the territorial principle is fact-specific for crypto exchanges and operators should not assume offshore-sourced profits qualify automatically. The Inland Revenue Department’s Departmental Interpretation and Practice Notes No. 39 (Revised) dated sets out the framework for digital-asset tax characterisation.[24]
| Tax | Rate | Crypto Application |
|---|---|---|
| Corporate Income Tax (two-tier) | 8.25% on first HKD 2m; 16.5% above | Taxable on HK-sourced trading profits per IRD DIPN 39 Revised |
| Capital Gains Tax | None | Long-term capital holdings non-taxable (badges-of-trade analysis applies) |
| Value Added Tax / GST | None | Hong Kong does not impose VAT or GST |
| Withholding Tax: dividends / interest | None | No withholding on outbound payments to non-residents |
| Withholding Tax: royalties | 4.95% / 16.5% | Standard Inland Revenue Ordinance rates apply to crypto-related royalties |
| Salaries Tax (employee) | Progressive to 17% | Crypto-denominated salaries taxable at market value on accrual |
| Stamp Duty | 0% on virtual assets | Tokenised ETFs listed on HKEX exempt per Policy Statement 2.0 |
The 8.25% rate applies to the first HKD 2 million of assessable profits, and only one entity in a group of connected entities can elect it. Capital gains are not taxed: long-term virtual-asset capital holdings of an investor (rather than a trader) generally fall outside the profits-tax net under standard badges-of-trade analysis.[24]
Crypto Asset Tax Treatment
IRD DIPN 39 (Revised) classifies digital tokens into three categories with different tax treatments. Payment tokens used as means of payment trigger taxable transactions at market value. Security tokens that legally constitute shares yield non-taxable capital receipts on issuance, with subsequent dividends and disposals taxed under standard share rules.
Utility tokens issued via ICO are generally taxable revenue receipts because the token is consideration for future services.[24] Crypto-denominated business income is taxable at market value on accrual; trading profits earned through a Hong Kong-sourced trade are taxable.
CRS / CARF Reporting
Hong Kong is a CRS Participating Jurisdiction and is committed to implementing CARF: the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 was gazetted on and its second reading was moved on ; on it remained before a LegCo Bills Committee, with the second-reading debate not yet resumed.[29] The OECD Global Forum list of 14 September 2026 places Hong Kong among the jurisdictions undertaking first exchanges by 2028.[28] Licensed VATPs and stablecoin issuers should expect to fall within the CARF reporting perimeter.
Pillar Two (Global Minimum Tax)
Hong Kong enacted the Inland Revenue (Amendment) (Minimum Tax for Multinational Enterprise Groups) Ordinance 2025 on , implementing the OECD Pillar Two GloBE rules for fiscal years starting on or after . Pillar Two applies to MNE groups with consolidated annual revenue of EUR 750 million or more in at least two of the four preceding fiscal years.[35] Standalone Hong Kong-domiciled VASPs below this threshold are not in scope; multinational crypto groups should run a Pillar Two impact assessment.
Ongoing Compliance & Post-Registration
A Hong Kong VATP licence is granted indefinitely subject to ongoing compliance. The SFC supervises through annual returns, financial returns, audited financial statements, periodic on-site inspections, and ad hoc thematic reviews. Material changes to business model, RO composition, custody arrangements, or token offerings require SFC notification or prior approval depending on type.[17]
Annual Reporting Obligations
- Audited annual financial statements filed with the SFC within four months of financial year-end.
- Monthly and annual financial returns under the Securities and Futures (Financial Resources) Rules: liquid capital monitoring, trigger notifications when liquid capital falls below 120% of required level or below 50% of the previous return.
- Annual compliance report by the Manager-in-Charge of Compliance.
- AML/CFT annual report including STR/SAR statistics, sanctions screening exceptions, ongoing-monitoring outputs.
- Periodic independent cybersecurity assessment, including penetration testing and vulnerability scanning, plus an at least annual independent technology audit.
- Token Admission and Review Committee monthly minutes documented and available on request.
Supervision Fees
Annual SFC fees per regulated activity are payable on the licence anniversary. The licence is not “renewed”: it remains in force indefinitely subject to compliance. The statutory side stays at HKD 42,660–53,400 a year. The programme around it runs HKD 3.6–10.1 million a year on our planning estimate and is quoted per case: audit, accounting and platform maintenance (HKD 300,000–600,000), Hong Kong office and substance (HKD 800,000–1,500,000), compliance officer and AML team (HKD 1,500,000–3,000,000), and the insurance or compensation arrangement (HKD 1,000,000–5,000,000).
Regulatory Inspections
The SFC conducts both scheduled annual reviews and unannounced thematic inspections. Recent themes (2024–2025) have included custody control effectiveness, market surveillance, and token admission methodology rigour. The SFC’s Intermediaries Supervision Department directly supervises VATPs.
Advertising and Promotion Rules
VATPs must not advertise virtual-asset services to retail clients in respect of tokens that are not retail-eligible. Marketing materials require pre-approval by the licensed corporation’s compliance function. The SFC keeps a public alert list of suspicious virtual asset trading platforms and flagged JPEX as unregulated in 2023.[2][25]
Enforcement
Operating a VATP without a licence carries up to a HKD 5 million fine and seven years’ imprisonment under AMLO §53ZRD. Stablecoin issuance without a licence carries up to a HKD 5 million fine and seven years’ imprisonment plus a HKD 100,000 daily continuing-offence fine under Cap 656. The JPEX matter ( onward) remains the principal enforcement precedent.
As reported following the Hong Kong Police Force briefing of (Hong Kong Free Press, November 2025), the JPEX investigation had led to 80 arrests and 16 prosecutions, with more than 2,700 people reporting losses exceeding HKD 1.6 billion.[25]
ICT Risk Management & Operational Resilience
Hong Kong’s technology and cyber rules for VATPs and stablecoin issuers are set out in three layers: SFC VATP Guidelines Part XII for cybersecurity, SFC VATP Guidelines Part X for custody (which includes prescriptive technology controls), and HKMA SPM modules TM-G-1, TM-G-2, and CYB-1 for stablecoin issuers and bank-side VA activities. The combined effect covers the same functional scope as the EU’s Digital Operational Resilience Act: ICT governance, incident management, resilience testing, ICT third-party risk, and information sharing, delivered through regulator-led guidance rather than horizontal statute.[26]
Applicable Frameworks
- SFC VATP Guidelines Part XII (Cybersecurity). Governance, secure software development lifecycle, change management, access controls, network security, penetration testing, vulnerability assessment, incident response, BCP, third-party risk, audit trails.
- SFC VATP Guidelines Part X (Custody of Client Assets). Hot/cold wallet segregation, HSM-based key storage, multi-signature thresholds, geographic key distribution, backup and recovery, compensation arrangements.
- HKMA SPM TM-G-1 (General Principles for Technology Risk Management). Applies to AIs and, by HKMA expectation, to licensed stablecoin issuers: governance, risk identification, ICT third-party risk management.
- HKMA SPM TM-G-2 (Business Continuity Planning). RTO/RPO targets, recovery testing, communications protocols.
- HKMA SPM CYB-1 (Cyber Resilience). Incorporates the Cybersecurity Fortification Initiative including C-RAF (Cyber Resilience Assessment Framework) and iCAST (intelligence-led cyber attack simulation testing).
Incident Reporting
VATPs must notify the SFC of material incidents: system disruptions, cyber attacks, client-asset loss events, material control failures, under the standing reporting obligations in the SFC Code of Conduct. Initial notification expected within hours; written follow-up within agreed timeframes. The SFC has signalled lower tolerance for delayed disclosure than for the underlying incident.
Resilience Testing
A stringent independent cybersecurity assessment, including penetration testing and vulnerability scanning, is required before launch or platform modifications and periodically thereafter, and a qualified independent professional must carry out a technology audit at least annually.[17] Test scope must cover the production trading environment, custody infrastructure, key-management systems, and external-facing applications. Adverse findings require remediation with timelines reported to the SFC.
Custody Technology
The SFC VATP Guidelines mandate Hardware Security Module (HSM) storage of private keys with appropriate certification, geographic distribution of key shares, multi-signature controls, and key-generation ceremonies conducted under documented procedures with witnesses. Cold-storage facilities require physical access controls and environmental protections. Client assets are held on trust only through the Associated Entity (a wholly-owned subsidiary with a Trust or Company Service Provider licence), not a third-party custodian;[17] the SFC’s November 2025 products and services circular lets the Associated Entity, on application, also hold tokens that are not traded on the platform.[32]
Banking
Banking for a Hong Kong-licensed VATP is materially easier than for an unlicensed crypto operator, but harder than for a traditional financial services firm. Across Jagelski & Partners’ partner network, onboarding for a licensed VATP typically takes two to six months. The HKMA’s circular Access to Banking Services for Corporate Customers explicitly instructed Authorised Institutions to apply a risk-based approach rather than wholesale de-risking, and the licensed-VATP banking landscape has shifted materially since.[6]
The institutions willing to bank licensed VATPs in Hong Kong fall into three archetypes. The first archetype is HK-licensed retail Authorised Institutions with a documented digital-asset risk appetite. These provide deep HKD and USD rails through FPS and SWIFT, support card issuance and payroll, and integrate with HKEX-listed corporate structures. The second archetype is locally-incorporated virtual banks with a digital-asset programme. These offer rapid onboarding, modern APIs, and digital-asset-native settlement features, with typically lower transaction limits than the major Authorised Institutions. The third archetype is adjacent-jurisdiction EMIs and payment institutions used for non-HKD fiat rails and faster cross-border settlement.
Stablecoin issuers under Cap 656 are themselves Authorised Institutions (in HSBC’s case) or partner with AIs for reserve custody. The reserve must be held under trust with a licensed bank or qualified custodian, segregated from issuer assets, held in HQLA matching the reference currency, and subject to monthly attestation.[8] The reserve banking arrangement is structurally different from the issuer’s operating account banking and is typically handled by global custody divisions of Tier-1 banks.
Jagelski & Partners’ banking partner network covers 90+ institutions across Hong Kong, the wider Asia-Pacific region, and Europe: corporate accounts, multi-currency IBANs, dedicated USD and HKD rails, and crypto-fiat settlement infrastructure. A licence without banking access is a certificate on the wall.
Explore Banking SolutionsFATF Status & International Standing
Hong Kong is an FATF member and appears on neither the FATF’s list of jurisdictions under increased monitoring nor its call-for-action list after the June 2026 plenary.[30] Its most recent mutual evaluation, a joint FATF and APG assessment, was published in 2019; a follow-up report of upgraded Recommendation 28 to Largely Compliant and kept Hong Kong in regular follow-up.[27] Hong Kong moved early on the Travel Rule and VATP licensing, both in force with the mandatory regime from .
EU Market Access
Hong Kong VATPs cannot lawfully provide services to EU clients without authorisation as a Crypto-Asset Service Provider (CASP) under the EU Markets in Crypto-Assets Regulation (MiCA). MiCA Article 61 contains a narrow “reverse solicitation” exemption for services initiated at the EU client’s own exclusive initiative. ESMA’s guidelines (published , applicable from ) list signs that a firm is likely to be regarded as soliciting, judged on all the facts; a firm that solicits EU clients cannot rely on the exemption, and the client’s initiative does not entitle the firm to market new types of crypto-assets or services to that client.
For operators with material EU demand, the practical path is parallel CASP authorisation in an EU member state. Member states with MiCA routes covered on this site include Malta, Estonia, Ireland and Lithuania; the choice depends on substance and timeline, and the MiCA CASP guide compares them. Reverse solicitation is a narrow exemption judged on all the facts, not a route to serve an EU client base. See the reverse solicitation under MiCA Article 61 guide for the boundary conditions and compliance considerations.
Asia-Pacific Standing
Hong Kong is also a member of the Asia/Pacific Group on Money Laundering (APG), the FATF-style regional body for the region. Hong Kong’s IOSCO membership, signatory status to the IOSCO Multilateral Memorandum of Understanding, and Mutual Recognition of Funds arrangements with mainland China, Switzerland, Thailand, and others provide additional cross-border infrastructure.
Advantages and Limitations
Hong Kong’s strengths and weaknesses both flow from the prescriptive nature of the regime. Operators trade higher upfront cost and longer timeline for substantive credibility, broad retail access, and tier-1 banking infrastructure.
- Substantive retail access. Retail clients can trade eligible large-cap virtual assets on licensed VATPs subject to disclosure, suitability, and exposure limits: broader retail scope than Singapore’s MAS regime.[3]
- Tier-1 financial centre status. Deep HKD and USD rails, full SWIFT and FPS access, IOSCO, and APG membership, Mutual Recognition of Funds with mainland China and other jurisdictions. Banking introductions move materially faster for licensed VATPs.[6]
- Clear tokenisation roadmap. Policy Statement 2.0 () and the LEAP framework provide forward visibility on tokenised ETF stamp-duty exemption, tokenised bond issuance, and the proposed profits-tax exemption for specified digital assets in qualifying funds.[4]
- Attractive tax base. Two-tier profits tax (8.25% / 16.5%), no capital gains tax, no VAT/GST, territorial source basis, no withholding on outbound dividends or interest to non-residents.[24]
- Expanding product scope. Staking permitted since ; perpetual contracts for professional investors permitted from ; expanded custody for tokenised securities and stablecoins from .[10][11]
- Operating regime track record. 13 SFC-licensed VATPs on the SFC’s list as of , 11 of them licensed since October 2024: the regime is proven, not theoretical.[2]
- No EU passporting. A Hong Kong licence does not authorise services into the EU. Mitigation: Operators targeting EU clients can obtain a separate CASP authorisation in an EU member state (passporting across the 30 EEA states); the narrow reverse solicitation exemption under MiCA Article 61 covers only services a client initiates at its own exclusive initiative, judged on all the facts.
- Long timeline. 12 to 18 months substantive engagement is typical; 24+ months for complex applicants. Mitigation: Begin pre-application engagement with the SFC’s Fintech Contact Point at least 18 months before intended go-live; appoint the external assessor early under the tripartite framework so engagement-readiness aligns with SFC on-site inspection.
- High cost. HKD 6.35 to 17.2 million Year 1 build, HKD 5 million paid-up share capital, and a separate required-liquid-capital test. Mitigation: Phase technology investment, negotiate compensation arrangement terms once SFC inspection feedback has been received, prioritise the substance build that the regulator weighs heavily.
- Prescriptive custody. The 98% cold storage threshold plus Associated Entity TCSP plus 50% / 100% compensation arrangement are fixed rules in the VATP Guidelines, not a firm-level risk choice. Mitigation: Design custody architecture in Stage 3; in our experience, late-stage custody redesigns are a frequent cause of rework under the external assessment.
- No US client access. A Hong Kong licence does not authorise services to US persons. Mitigation: Operate geo-blocking and IP-jurisdiction screening from launch; do not rely on customer self-declaration alone for US-resident screening.
- Limited stablecoin issuer licensing. Only two HKMA stablecoin issuer licences granted as of from 36 first-batch applications. Mitigation: For non-stablecoin business models the VATP licence is the primary path; would-be stablecoin issuers should expect long sandbox participation prior to formal application.
How Hong Kong Compares
Hong Kong’s natural Asia-Pacific peers are Singapore (MAS Payment Services Act DPT regime), Australia (AUSTRAC VASP registration and the Digital Asset Platform regime commencing ), and the UAE (VARA in Dubai, FSRA in ADGM). Malta (CASP under MiCA) is the cross-tier reference for operators weighing an EU-passportable alternative against APAC presence.
| Factor | Hong Kong | Singapore | Australia | UAE |
|---|---|---|---|---|
| Licence Type | SFC VATP (Type 1 + 7 + AMLO Part 5B) | MAS Major Payment Institution DPT licence | AUSTRAC VASP registration (ex-DCE) + ASIC AFSL for financial products | VARA Dubai or FSRA ADGM activity-specific |
| Regulator | SFC (HKMA for stablecoins) | Monetary Authority of Singapore | AUSTRAC + ASIC | VARA (Dubai) / FSRA (ADGM) |
| Timeline | 12–18 months | More than a year before MAS review; total longer | About 2–5 months for AUSTRAC registration; 7–12 months with an AFSL | 6–12 months (VARA); 12+ for an Exchange |
| Min. Capital | HKD 5m paid-up; required liquid capital is the higher of HKD 3m and the basic amount≈ $640K paid-up; $380K liquid floor | SGD 250,000 (MPI)≈ $200K | None for AUSTRAC; AFSL: no general floor, AUD 10m NTA for custodians | AED 1.5m exchange without VARA custody≈ $410K |
| Total Year 1 cost | USD 810K–2.2M | USD 810K–2.1M | USD 130K–360K | USD 360K–2M (VARA route) |
| Corporate Tax | 16.5% / 8.25% two-tier | 17% standard | 30% (25% base-rate) | 9% federal CT |
| Local Presence | ≥2 ROs, ≥1 HK-resident | ≥1 SG-resident exec director | AU-resident director (Pty Ltd) + AML/CTF compliance officer | Dubai or ADGM presence + senior management |
| EU Passporting | No | No | No | No |
| FATF Status | FATF member; not grey-listed or black-listed (as of 19 June 2026) | FATF member; not grey-listed or black-listed (as of 19 June 2026) | FATF member; not grey-listed or black-listed (as of 19 June 2026) | Not a FATF member; MENAFATF-assessed; off grey list |
| Best For | Established exchanges targeting APAC retail and institutional flow with substantive banking needs | Institution-focused DPT operators wanting MAS credibility and deep banking | Domestic AU operators and Asia-Pacific entry via AU subsidiary | Crypto-native operators prioritising speed and lower upfront cost |
Compare every crypto jurisdiction side by side →
Ranked on first-year operating spend, before capital, Hong Kong sits mid-range among the major Asia-Pacific regulated regimes: above the UAE’s VARA entry point, broadly comparable to Singapore’s MPI route, and below the HKMA Stablecoin Issuer track. Financial resources sit on a separate axis: a VATP maintains HKD 5 million paid-up share capital plus required liquid capital equal to the higher of HKD 3 million and the basic amount, while the HKMA requires HKD 25 million paid-up capital of a stablecoin issuer. The differentiated value is substantive retail access combined with tier-1 banking infrastructure under one regulatory roof. For institution-focused operators, Singapore offers MAS supervision on a comparable operating spend, but its pre-review queue exceeds a year. For operators prioritising a lower entry cost, the UAE; its VARA route licenses simpler activities in 6 to 12 months, while an Exchange takes 12 months or longer.
For operators weighing Hong Kong against an EU CASP alternative under MiCA, the trade-off is APAC institutional access (Hong Kong) versus EEA-wide passporting (Malta and other EU member states). A group can hold both: Hong Kong for APAC, an EU CASP for European market access. Singapore’s regime is described in the Singapore crypto licensing guide; the UAE’s regime in the Dubai crypto licensing guide.
When Hong Kong Is the Right Choice
Choose Hong Kong if:
- The business model requires substantive retail access in Asia-Pacific with tier-1 banking and credibility for institutional partnerships.
- Long-term commitment to the market justifies the 12-to-18-month timeline and HKD 6.35–17.2 million Year 1 build.
- Stablecoin issuance referencing HKD is in scope: the HKMA Stablecoin regime is the only path.
- Tokenisation and RWA strategies are central: Policy Statement 2.0’s roadmap provides explicit support.
Consider alternatives if:
- The business model is institution-focused and Singapore’s narrower retail offering is acceptable: see Singapore.
- Lower upfront cost, or faster licensing of a simpler activity, is paramount: see Dubai (VARA: 6–12 months for simpler activities; 12 months or longer for an Exchange).
- EU market access is the primary requirement: see Malta for MiCA passporting.
- Domestic Australia is the focus: see Australia for the AUSTRAC + ASIC path.
Hong Kong Company Formation
Limited company under Cap 622, company secretary, registered office, business registration, and the banking reality for a Hong Kong company.
Open a Crypto Business Account
Banking introductions through 90+ specialist institutions for licensed VATPs and stablecoin issuers across Hong Kong and APAC.
Malta MiCA CASP Licence
For operators needing EU passporting in parallel with Hong Kong APAC presence: MiCA CASP authorisation with passporting across the EEA.
Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.
Common Mistakes in Hong Kong Applications
The SFC’s stated expectations on VATP applicants emphasise substantive operational readiness rather than paper compliance. Most stalled applications fail during SFC on-site inspection or at the single external assessment stage: the substantive validation rounds rather than the document submission itself.
- Treating compliance documentation as a template exercise. The SFC and the external assessor both read the AML/CFT manual, token admission policy, custody procedures, and conflicts policy as primary evidence of governance maturity. Generic templates with Hong Kong references stitched in fail consistently. Build the documents around the actual business model and the specific token universe the applicant intends to trade.
- Underestimating Responsible Officer substance. At least two ROs approved by the SFC, at least one ordinarily resident in Hong Kong and at least one an executive director. In practice, a sole HK-resident RO who has just relocated, without Hong Kong regulated-firm experience, draws close questioning.
- Late custody redesign. Custody architecture (Associated Entity TCSP, 98% cold storage, HSM specifications, key-management ceremony, compensation arrangement structure) drives the external assessor’s work. Applicants who design custody late, after the application is in flight, trigger rework cycles that add three to six months to the timeline.
- Insufficient compensation arrangement scoping. The 50% cold + 100% hot compensation requirement is a hard rule. Operators with HKD 1 billion+ AUC find market-rate insurance pricing exceeds their original budget. Quote compensation arrangement coverage in parallel with external assessor engagement, not after.
- Token admission methodology gaps for retail-track applications. Except for Relevant Stablecoins, retail eligibility requires inclusion in ≥2 acceptable indices from independent providers, ≥1 IOSCO-compliant.[33] Many applicants name an index without verifying that the provider is independent of both the VATP and the token issuer: an external assessment finding that delays approval-in-principle.
- Ignoring the 12-month operating-expense liquid asset cushion. The HKD 3 million liquid capital minimum is the floor; the SFC additionally expects sufficient liquid assets (virtual assets excluded) to cover 12 months of operating expenses. Applicants who size capital to the minimum without modelling Year 1 operating burn rate fail the FRR review.
Frequently Asked Questions
Yes. Retail token admission normally requires inclusion in at least two acceptable independent indices, with at least one meeting IOSCO standards. Relevant Stablecoins are exempt: they must be specified stablecoins issued and authorised under an HKMA licence. The SFC circular of removes their liquidity and index tests and excludes them from client exposure calculations.[33]
Clients served only in Relevant Stablecoins need no virtual-asset knowledge assessment. Suitability still applies when the platform recommends or solicits a transaction; disclosures must explain stabilisation and redemption.
The applicant entity must be incorporated in Hong Kong (or a non-Hong Kong company registered under Cap 622 Part 16) with a principal place of business in Hong Kong. At least two Responsible Officers must be SFC-licensed; at least one must ordinarily reside in Hong Kong and at least one must be a director. Beneficial owners need not reside in Hong Kong but must pass the SFC’s fit-and-proper test covering financial standing, reputation, prior regulatory record, and competence.
It depends on the licence route. An AMLO-only VATP licence covers non-security tokens and does not itself authorise securities services. The dual SFO/AMLO VATP route includes Type 1 and Type 7 permissions for trading security tokens, with related custody, subject to licence, product and listing conditions. Hong Kong applies a see-through approach: a tokenised security is a traditional security with a tokenisation wrapper, so the Securities and Futures Ordinance (Cap 571) and the prospectus regime apply in full. Issuance and public-offer approvals, and advising (Type 4) or asset-management (Type 9) permissions, are assessed separately. We scope the securities-token route through the SFO permissions and the fund route through fund licensing.
Allow 12 to 18 months from substantive preparation to grant as a planning estimate, with complex applications taking 24+ months. The VATP Licensing Handbook does not set a fixed processing period: scope, internal controls, application quality and responses to the SFC affect timing. The general 15-week corporate-licensing estimate is not a VATP approval deadline. Inspection, remediation, external assessment and penetration testing must fit into the launch plan.[21]
An SFC VATP licence (Securities and Futures Ordinance Type 1 + Type 7 plus AMLO Part 5B) authorises operation of a centralised virtual-asset trading platform. An HKMA Stablecoin Issuer licence (Stablecoins Ordinance Cap 656) authorises issuance of fiat-referenced stablecoins, including HKD-referenced stablecoins issued anywhere. The regulators, capital requirements (HKD 5m paid-up plus a separate liquid-capital test for a VATP, versus HKD 25m paid-up for a stablecoin issuer), governance frameworks, and application processes are all different. An entity carrying out both activities needs both licences.
The statutory bill is published: SFC and AMLO application, approval and annual fees come to about HKD 42,660–53,400 for a dual-regime platform with two responsible officers, in Year 1 and every year after. The build is quoted per case; on our planning estimate its ten lines sum to HKD 6.35–17.2 million in Year 1. The largest are legal counsel (HKD 1.5–3m), the compensation arrangement (HKD 1–5m a year), the technology stack (HKD 1–3m), compliance documentation (HKD 800k–1.5m), Hong Kong office and substance (HKD 800k–1.5m a year), and a single external assessment under the HKSAE 3000 tripartite framework (HKD 500k–1.5m); the penetration test, audit, local representative, and company formation make up the rest.
Separately, the operator must maintain HKD 5m paid-up share capital and required liquid capital equal to the higher of HKD 3m and the basic amount. Those are distinct tests, not a fixed HKD 8m sum, so there is no single fixed all-in cash figure.
Compare like with like. On Year-1 operating spend excluding capital, Hong Kong runs HKD 6,392,660–17,253,400, broadly comparable to Singapore’s MAS Major Payment Institution route once its base capital and security deposit are stripped out, and above Dubai’s VARA entry point.
Hong Kong then applies two separate financial-resource tests: HKD 5m paid-up share capital and required liquid capital equal to the higher of HKD 3m and the basic amount. They are not an additive HKD 8m floor, and the basic amount varies, so a fixed all-in cash comparison would be misleading. The operating spend is driven by the prescriptive custody and compensation architecture: the 98% cold-storage threshold, the Associated Entity TCSP requirement, the 50%/100% compensation arrangement, a single external assessment under the HKSAE 3000 tripartite framework, and an independent penetration test. What the spend buys is substantive retail access, tier-1 banking infrastructure, and the SFC’s credibility for institutional partnerships.
Materially easier than for unlicensed crypto operators, but not trivial. Onboarding typically runs two to six months for licensed VATPs, on our partner-network experience. The HKMA’s circular instructed Authorised Institutions to apply a risk-based approach to corporate banking rather than wholesale de-risking, and the licensed-VATP banking landscape has shifted materially since. Acceptance still varies by business model, expected transaction volumes, settlement currencies, and customer geography. Jagelski & Partners’ banking partner network supports the introduction process.
Yes, since the SFC’s Circular on Staking Services (, ref 25EC22), subject to prior written SFC approval. VATPs must conduct third-party due diligence, manage validator and slashing risks, disclose protocols and fees, and obtain modified licensing conditions before launching staking services. Lending and other yield-generating products remain restricted. The September 2025 SFC–HKMA Supplemental Joint Circular further refined the position for intermediaries.
Only in materially restricted circumstances. A Hong Kong VATP that solicits EU clients cannot lawfully serve them without authorisation as a Crypto-Asset Service Provider under MiCA.[37] MiCA Article 61 permits reverse solicitation only where the EU client initiated the service at their own exclusive initiative; ESMA’s Guidelines published (applicable from ) list signs that a firm is likely to be regarded as soliciting, judged on all the facts; a firm that solicits EU clients cannot rely on the exemption, and the client’s initiative does not cover new types of crypto-assets or services. Operators with material EU demand should obtain CASP authorisation in an EU member state.
No. A Hong Kong VATP licence is Hong Kong-specific. Operations outside Hong Kong require separate licensing in the relevant jurisdiction. The SFC Shared Order Book circular of permits operational integration with affiliated overseas VATPs subject to prior approval and unified surveillance, but this is not a regulatory passport; it remains a single-licence model.
Limited. Of 36 applications received by the deadline, the HKMA granted only two licences on : to Anchorpoint Financial (a Standard Chartered Hong Kong, HKT, and Animoca Brands consortium) and HSBC. HKMA Chief Executive Eddie Yue stated in his April 2026 inSight commentary that further grants “will remain very limited”. Operators considering an HKMA Stablecoin Issuer application should expect long sandbox participation and substantive demonstration of risk management capability before formal application succeeds.
The FSTB and the SFC published consultation conclusions on VA dealing and VA custodian regimes in December 2025 and on VA advisory and VA management regimes in May 2026. The Government’s stated target is one bill covering all four regimes, introduced into LegCo within 2026; no such bill appeared in the LegCo bills database on 28 September 2026.[29]
The conclusions rule out a deeming arrangement: each regime takes full effect on its commencement date, which is not yet set, so existing providers must be licensed by then or stop. The conclusions encourage providers to contact the SFC early.
Start your Hong Kong VATP application
Jagelski & Partners scopes your written brief and introduces an independent specialist who runs the licensing application and banking work. Book a free assessment and we'll map your route to approval.
Not ready to submit a brief? Ask Emma first. She answers now and can collect your written brief for a specialist introduction.
References
Show all references
- Hong Kong Monetary Authority, Register of Licensees under the Stablecoins Ordinance (Cap. 656), hkma.gov.hk, accessed .
- Securities and Futures Commission of Hong Kong, Lists of virtual asset trading platforms, sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, Consultation Conclusions on the Proposed Regulatory Requirements for Virtual Asset Trading Platform Operators Licensed by the Securities and Futures Commission, , sfc.hk, accessed .
- Financial Services and the Treasury Bureau, Policy Statement 2.0 on the Development of Digital Assets in Hong Kong, , info.gov.hk, accessed .
- Inland Revenue Department of Hong Kong, A Brief Guide to Taxes Administered by the Inland Revenue Department, ird.gov.hk, accessed .
- Hong Kong Monetary Authority, Access to Banking Services for Corporate Customers, , hkma.gov.hk, accessed .
- Hong Kong e-Legislation, Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022, Cap. 615, elegislation.gov.hk, accessed .
- Hong Kong e-Legislation, Stablecoins Ordinance, Cap. 656, elegislation.gov.hk, accessed .
- Hong Kong Government, Stablecoins Ordinance to commence operation on August 1, 2025, , info.gov.hk, accessed .
- Securities and Futures Commission of Hong Kong, A high-level framework for virtual asset perpetual contracts offering by virtual asset trading platforms, , sfc.hk, accessed .
- Davis Polk & Wardwell LLP, Hong Kong permits virtual asset exchanges to access global liquidity and expand product offering, , davispolk.com, accessed .
- Securities and Futures Commission of Hong Kong, Circular on Staking Services Provided by SFC-licensed Virtual Asset Trading Platforms, , ref 25EC22, sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, ASPIRe Regulatory Roadmap for Virtual Asset Markets, , ref 25PR20, sfc.hk, accessed .
- Customs and Excise Department, Money Service Operators Licensing Office: Licensee List, data.gov.hk, accessed .
- Securities and Futures Commission of Hong Kong and Hong Kong Monetary Authority, Joint Circular on Intermediaries’ Virtual Asset-related Activities, ref 23EC67 (, superseding the 20 October 2023 circular; supplemental ref 25EC50 dated ), sfc.hk, accessed .
- Financial Services and the Treasury Bureau and Securities and Futures Commission of Hong Kong, Public Consultation on the Legislative Proposals to Regulate Virtual Asset Dealing Services and Virtual Asset Custodian Services in Hong Kong, , fstb.gov.hk; Consultation Conclusions on VA dealing and VA custodian services (December 2025, no deeming arrangement), fstb.gov.hk; press release on the VA advisory and management conclusions and the target of one bill within 2026, , info.gov.hk, accessed .
- Securities and Futures Commission of Hong Kong, Guidelines for Virtual Asset Trading Platform Operators, paragraphs 6.1 to 6.3 and 6.9 (financial resources), 10.1 (custody through the Associated Entity), 10.22 (compensation arrangement), 12.7 (technology audit at least annually), and 12.13 (independent cybersecurity assessment before launch or modifications and periodically thereafter), sfc.hk, verified .
- Securities and Futures Commission of Hong Kong, Fit and Proper Guidelines, sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations and SFC-licensed Virtual Asset Service Providers), , sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, Application Procedures for Licensed Corporations, sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, Licensing Handbook for Virtual Asset Trading Platform Operators, , paragraphs 3.2.3 to 3.2.7 (responsible officers), 6.3.2 (application fees) and 8.10.1 (annual fees), sfc.hk, accessed .
- Hong Kong e-Legislation, Securities and Futures (Fees) Rules, Cap 571AF, elegislation.gov.hk, accessed .
- Clifford Chance, Securities and Futures Commission finalises new regulatory requirements for VATP operators, 2023, cliffordchance.com, accessed .
- Inland Revenue Department of Hong Kong, Departmental Interpretation and Practice Notes No. 39 (Revised): Profits Tax: Digital Economy, Electronic Commerce, and Digital Assets, , ird.gov.hk, accessed .
- Hong Kong Free Press, 16 charged in JPEX crypto fraud case: over 2 years since initial arrests, , hongkongfp.com, accessed .
- Hong Kong Monetary Authority, Supervisory Policy Manual: Banking Regulatory Document Repository, hkma.gov.hk, accessed .
- Financial Action Task Force, Hong Kong, China: Mutual Evaluation Reports, fatf-gafi.org, accessed .
- OECD Global Forum on Transparency and Exchange of Information for Tax Purposes, Jurisdictions committed to implement the Crypto-Asset Reporting Framework (CARF) in time to commence exchanges in 2027, 2028 or 2029 (last update 14 September 2026), oecd.org, accessed .
- Legislative Council of Hong Kong, Bills Database (open data): bills gazetted in 2026 (16 bills gazetted to 14 July 2026; no virtual-asset dealing, custodian, advisory or management bill; the CARF bill of 22 May 2026: first reading on 3 June 2026, Bills Committee formed on 5 June 2026, no date recorded for the resumed second reading), app.legco.gov.hk, accessed ; Financial Services and the Treasury Bureau, LegCo Bills and Resolutions (3 June 2026: speech moving the Second Reading of the CARF bill), fstb.gov.hk, accessed .
- Financial Action Task Force, Jurisdictions under Increased Monitoring – 19 June 2026 and High-Risk Jurisdictions subject to a Call for Action – 19 June 2026 (Hong Kong, China on neither list; listed among FATF member countries), fatf-gafi.org, accessed ; Hong Kong, China: follow-up report, (Recommendation 28 upgraded to Largely Compliant; regular follow-up), fatf-gafi.org.
- Hong Kong Monetary Authority, Robust development of the regulated stablecoin ecosystem in Hong Kong (inSight article by Eddie Yue), , hkma.gov.hk, accessed .
- Securities and Futures Commission of Hong Kong, Circular on expansion of products and services of virtual asset trading platforms, ref 25EC57, , sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, Circular on provision of Relevant Stablecoin service by virtual asset trading platforms and licensed corporations, ref 26EC26, , sfc.hk, accessed .
- Securities and Futures Commission of Hong Kong, press releases SFC launches trading initiatives to boost digital asset market vibrancy in Hong Kong (, sfc.hk), SFC unveils new regulatory framework to allow secondary trading of tokenised SFC-authorised investment products (, sfc.hk) and SFC mandates phishing-resistant authentication methods for internet brokers and VATPs to protect client accounts (, sfc.hk), accessed .
- Inland Revenue Department of Hong Kong, Global minimum tax and Hong Kong minimum top-up tax for multinational enterprise groups (Amendment Ordinance enacted 6 June 2025; groups with revenue of EUR 750 million or above in at least two of the four preceding fiscal years), ird.gov.hk, accessed .
- European Commission, Commission Delegated Regulation (EU) 2016/1675 identifying high-risk third countries with strategic AML/CFT deficiencies, consolidated text of (Hong Kong not listed), eur-lex.europa.eu, accessed .
- European Union, Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Articles 59(1) and 61, eur-lex.europa.eu, accessed .
- Hong Kong, Stablecoins Ordinance, Ordinance No. 17 of 2025, section 22 and Schedule 3, legco.gov.hk; Hong Kong Monetary Authority, Explanatory Notes on Licensing of Stablecoin Issuers, paragraph 5.1.1, hkma.gov.hk, accessed .
- Securities and Futures Commission, Regulatory standards for licensed corporations managing virtual asset portfolios, scope of supervision (a) to (c), sfc.hk; Other virtual asset related activities, virtual asset fund managers, sfc.hk, accessed .