Introduction
Hong Kong's mandatory licensing regime for virtual asset service providers (VASPs) represents one of the most significant regulatory developments in the city's financial history. Under amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO), any person carrying on a business of operating a virtual asset exchange (VAEX) in Hong Kong — or actively marketing such services to Hong Kong investors — must hold a licence from the Securities and Futures Commission (SFC).
This guide explains how the VASP licensing framework operates, who it applies to, what the licensing requirements are, and what obligations apply to licensed VASPs.
Background: The Shift to Mandatory Licensing
Prior to June 2023, Hong Kong operated a voluntary opt-in licensing regime for centralised virtual asset exchanges under the SFC. Only exchanges that chose to be licensed — and that allowed trading of at least one security token — were regulated under the Securities and Futures Ordinance (SFO).
The passage of the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022 replaced this voluntary framework with a mandatory VASP licensing regime. From 1 June 2023, operating a virtual asset exchange (a platform that buys, sells, or exchanges virtual assets against fiat currency or other virtual assets) in Hong Kong without an SFC licence became a criminal offence.
Who Needs a VASP Licence?
Any person who, in the course of business, operates a virtual asset exchange (VAEX) in Hong Kong must hold a VASP licence from the SFC. A VAEX is a centralised platform that operates an exchange or a market for buying, selling, or exchanging virtual assets. The licensing requirement applies regardless of whether the virtual assets traded are securities.
The requirement also catches persons who, from outside Hong Kong, actively market VAEX services to Hong Kong investors — the SFC has indicated it will treat such persons as operating in Hong Kong for licensing purposes.
Peer-to-peer trading platforms, decentralised exchanges (DEXs), and OTC desks that do not operate a centralised matching engine may fall outside the VAEX definition, but the SFC has indicated it will consider the substance of operations rather than the labels used.
The Licensing Application Process
Applying to the SFC
Applicants for a VASP licence must submit a detailed application to the SFC, including information about the applicant's business model, corporate structure, management team, financial resources, technology systems, compliance arrangements, and risk management framework. The SFC has published detailed guidance on the information it expects to receive, including an expectation that applicants demonstrate robust anti-money laundering and counter-terrorist financing (AML/CTF) controls.
Fit and Proper Requirements
All responsible officers and substantial shareholders of a VASP must be fit and proper. This includes demonstrating good character, relevant competence and experience in the virtual asset industry or financial services, and financial soundness. The SFC scrutinises both the individuals and the corporate structure behind the applicant.
Financial Requirements
Licensed VASPs must maintain minimum paid-up share capital of HK$5 million and liquid capital of at least HK$3 million (or one-twelfth of annual operating expenses, whichever is higher). VASPs must also maintain a reserve in the form of insurance or a cold wallet reserve covering client virtual assets.
Core Licensing Conditions
Retail Access
By default, VASP licences allow trading by professional investors only. A licensed VASP may apply to the SFC for permission to extend services to retail investors, subject to satisfying enhanced requirements around token due diligence, client suitability assessments, onboarding procedures, and token eligibility (only large-cap tokens meeting specified criteria may be offered to retail clients).
Custody of Client Assets
Licensed VASPs must maintain at least 98% of client virtual assets in cold storage. Hot wallet holdings are limited to 2% of total client virtual assets. VASPs must also maintain an insurance policy or similar arrangement to protect against losses from hot wallet holdings. Client assets must be held on trust and segregated from the VASP's own assets.
Token Admission and Due Diligence
VASPs must conduct thorough due diligence before listing any virtual asset for trading. The SFC has published detailed token admission criteria, covering smart contract audits, project team backgrounds, whitepaper disclosures, liquidity, market capitalisation, and token distribution. Certain categories of tokens — including those that qualify as securities under Hong Kong law — require additional regulatory approvals.
AML/CTF Obligations
Licensed VASPs are subject to the full AML/CTF regime under the AMLO, including customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk customers, transaction monitoring, suspicious transaction reporting, record-keeping, and compliance with the Travel Rule for virtual asset transfers. The SFC has published detailed AML/CTF guidelines specifically for VASPs.
Prevention of Market Manipulation
Licensed VASPs must implement market surveillance systems to detect and prevent market manipulation, wash trading, and other forms of market abuse. They are required to maintain records of all trading activity and to cooperate with SFC investigations.
The Transition Framework
Exchanges that were already operating in Hong Kong before 1 June 2023 were eligible to apply under the transition framework, which allowed them to continue operating on a provisional basis while their licence application was being assessed. The transition period provided a runway for incumbents to meet the new regulatory requirements and submit compliant applications.
Exchanges that failed to apply during the transition window — or whose applications were rejected — were required to cease operations and wind down their Hong Kong business in an orderly manner. The SFC published guidance on wind-down requirements to protect client assets during the cessation process.
Ongoing Obligations of Licensed VASPs
Once licensed, VASPs are subject to ongoing SFC supervision, including regular audits, financial reporting obligations (including annual financial statements audited by an SFC-approved auditor), notification requirements for material changes to business (including changes to responsible officers, ownership, and technology systems), and cooperation with SFC inspections and investigations.
The SFC may impose conditions on a VASP licence, vary existing conditions, suspend, or revoke a licence if the VASP fails to meet ongoing requirements or engages in conduct detrimental to investors or market integrity.
Stablecoins and Other Developments
The VASP licensing regime focuses on virtual asset exchanges and does not, by itself, cover stablecoin issuers. Hong Kong has separately introduced a licensing regime for stablecoin issuers under the Stablecoins Ordinance, administered by the Hong Kong Monetary Authority (HKMA). VASPs that list or trade stablecoins must consider both the VASP licensing requirements and the stablecoin regulatory framework.
Conclusion
Hong Kong's VASP licensing regime represents a comprehensive, internationally-aligned framework for regulating cryptocurrency exchanges. For virtual asset businesses operating in or targeting Hong Kong, obtaining a VASP licence is both a legal requirement and a commercial necessity. The licensing process is rigorous, but a successful licence application provides a strong regulatory foundation and access to one of Asia's most significant virtual asset markets.
Alan Wong LLP advises virtual asset service providers on SFC licensing applications, regulatory compliance, and corporate structuring in Hong Kong. Contact us to discuss your VASP licensing needs.
Disclaimer: This article is provided for general information only and does not constitute legal, regulatory, tax, accounting or other professional advice. It should not be relied upon as a substitute for advice on specific facts and circumstances. Reading this article does not create a solicitor-client, attorney-client or other professional relationship with Alan Wong LLP. The information is current as at the date of publication and may be subject to change. Alan Wong LLP accepts no responsibility for any loss arising from reliance on this article.
