How to Get a VASP Licence in Hong Kong: A Practical Guide

The introduction of mandatory licensing for virtual asset trading platforms (VATPs) under Part VIA of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) has fundamentally changed the operating landscape for crypto exchanges, OTC desks, and related businesses in Hong Kong. Since the regime came into force on 1 June 2023, operating a VATP in Hong Kong without a licence from the Securities and Futures Commission (SFC) is a criminal offence carrying significant penalties.

This guide explains what the VASP licensing regime covers, who needs to apply, the key requirements the SFC will assess, and the practical steps involved in obtaining a licence.

Does Your Business Need a VASP Licence?

A VASP licence is required for any person who carries on a business of operating a virtual asset trading platform in Hong Kong. Under AMLO Part VIA, a VATP is broadly defined as an online platform that provides services for buying and selling virtual assets where the operator has a legitimate expectation of deriving income or gains from that activity.

The regime applies where:

• The platform is operated in Hong Kong — managed or controlled from Hong Kong;
• The platform is actively marketed to persons in Hong Kong; or
• At the time of the relevant transaction, the user is in Hong Kong.

Several important carve-outs exist. Non-fungible tokens (NFTs) that are genuinely unique and non-fungible are not currently classified as virtual assets for licensing purposes, though fractionalised or fungible NFTs require careful analysis. Virtual assets that qualify as securities under the Securities and Futures Ordinance (SFO) are regulated under that separate regime rather than the VASP regime, though the two may overlap for platforms dealing in security tokens. Purely peer-to-peer transactions without an intermediary platform operator do not typically trigger the licensing requirement.

The Four Core Licensing Requirements

The SFC's VASP licensing framework assesses applicants across four areas:

1. Fit and proper persons

The licensed corporation and each of its responsible officers (ROs) must be fit and proper. Each licensed VASP must have at least two individuals approved by the SFC as Responsible Officers for the relevant regulated activity, at least one of whom must be ordinarily resident in Hong Kong. The fit and proper assessment covers financial soundness, relevant competence and experience, and the absence of relevant criminal convictions or regulatory sanctions.

2. AML/CFT compliance

Licensed VASPs must implement and maintain a robust AML/CFT programme compliant with AMLO and the SFC's published guidelines. This encompasses customer due diligence (CDD) and enhanced due diligence (EDD) procedures, ongoing transaction monitoring, suspicious transaction reporting to the Joint Financial Intelligence Unit (JFIU), and comprehensive record-keeping for a minimum of five years.

3. Safeguarding client assets

Client virtual assets must be held in segregated accounts and properly safeguarded. The SFC's licensing conditions impose detailed requirements on custody arrangements, including prescribed minimum percentages of assets held in cold storage, key management procedures, and restrictions on the use or hypothecation of client assets.

4. Financial resources and insurance

Applicants must demonstrate adequate financial resources and maintain the minimum liquid capital required by the Securities and Futures (Financial Resources) Rules. The SFC also expects licensed VASPs to maintain appropriate insurance or a compensation arrangement to cover potential losses arising from cybersecurity incidents or internal misconduct.

The Application Process

A VASP licence application proceeds through four broad stages:

Stage 1: Pre-application preparation (2–4 months)

Thorough preparation before submission substantially reduces the risk of additional information requests and delays. Key pre-application steps include conducting a regulatory mapping of the business model against the VASP regime; drafting AML/CFT policies and procedures to AMLO standards; commissioning an independent IT security assessment; identifying and vetting proposed responsible officers; and preparing the required corporate documentation including group structure charts and a detailed business plan. A pre-application meeting with the SFC can be a valuable opportunity to clarify its expectations for the specific business model.

Stage 2: Submission via WINGS

Applications are submitted through the SFC's WINGS online portal. The submission package includes the Form 1 corporation licence application, Form 4 notifications for each proposed Licensed Representative, Form 5A nominations for each proposed Responsible Officer, and a supporting document bundle. Applications that are incomplete or inadequately prepared will be returned without substantive review, adding months to the timeline.

Stage 3: SFC review (3–6 months)

The SFC will review the application and issue Additional Information Requests (AIRs) as the review progresses. The SFC may also conduct interviews of proposed Responsible Officers as part of the fit and proper assessment. The review period depends on the complexity of the application and the quality of the submission. Well-prepared applications that anticipate the SFC's areas of concern — particularly on AML/CFT policies and custody arrangements — move through review meaningfully faster than poorly prepared submissions.

Stage 4: Licence grant and ongoing compliance

Upon approval, the SFC issues a licence subject to standard and bespoke conditions. Post-licence, VASPs must file annual returns and audited financial accounts, obtain SFC approval before launching new products or making material changes to operations, and maintain ongoing compliance with all licensing conditions. The SFC conducts periodic inspections of licensed VASPs and may request production of books and records at any time.

Timeline and Practical Considerations

The total timeline from engaging advisers to receiving a licence commonly ranges from 9 to 18 months. Key factors that extend timelines include regulatory or disciplinary history of proposed Responsible Officers, inadequate AML/CFT policies at submission, unresolved questions on custody or financial resources, and complex group ownership structures requiring additional background checks.

Businesses considering operating a VATP in Hong Kong should assess their regulatory position before commencing any operations. Operating without a licence — including during the pre-application phase unless specific transitional provisions apply — constitutes a criminal offence under AMLO and may give rise to significant civil and reputational consequences.

Alan Wong LLP advises virtual asset exchanges, token issuers, and fintech businesses on VASP licensing, SFC compliance, and digital asset regulation in Hong Kong. Contact us to discuss your licensing requirements.