Cryptocurrency Exchange Licensing in Hong Kong: The VASP Regime Explained

Introduction

Hong Kong's mandatory licensing regime for virtual asset service providers (VASPs) represents one of the most significant regulatory developments in the city's financial history. Under amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615) (AMLO), any person carrying on a business of operating a virtual asset exchange (VAEX) in Hong Kong, or actively marketing such services to Hong Kong investors, must hold a licence from the Securities and Futures Commission (SFC).

This guide explains how the VASP licensing framework operates, who it applies to, what the licensing requirements are, and what obligations apply to licensed VASPs.

Background: The Shift to Mandatory Licensing

Prior to June 2023, Hong Kong operated a voluntary opt-in licensing regime for centralised virtual asset exchanges under the SFC. Only exchanges that chose to be licensed, and that allowed trading of at least one security token, were regulated under the Securities and Futures Ordinance (SFO).

The passage of the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022 replaced this voluntary framework with a mandatory VASP licensing regime. From 1 June 2023, operating a virtual asset exchange (a platform that buys, sells, or exchanges virtual assets against fiat currency or other virtual assets) in Hong Kong without an SFC licence became a criminal offence.

Who Needs a VASP Licence?

Any person who, in the course of business, operates a virtual asset exchange (VAEX) in Hong Kong must hold a VASP licence from the SFC. A VAEX is a centralised platform that operates an exchange or a market for buying, selling, or exchanging virtual assets. The licensing requirement applies regardless of whether the virtual assets traded are securities.

The requirement also catches persons who, from outside Hong Kong, actively market VAEX services to Hong Kong investors; the SFC has indicated it will treat such persons as operating in Hong Kong for licensing purposes.

Peer-to-peer trading platforms, decentralised exchanges (DEXs), and OTC desks that do not operate a centralised matching engine may fall outside the VAEX definition, but the SFC has indicated it will consider the substance of operations rather than the labels used.

The Licensing Application Process

Applying to the SFC

Applicants for a VASP licence must submit a detailed application to the SFC, including information about the applicant's business model, corporate structure, management team, financial resources, technology systems, compliance arrangements, and risk management framework. The SFC has published detailed guidance on the information it expects to receive, including an expectation that applicants demonstrate robust anti-money laundering and counter-terrorist financing (AML/CTF) controls.

Fit and Proper Requirements

All responsible officers and substantial shareholders of a VASP must be fit and proper. This includes demonstrating good character, relevant competence and experience in the virtual asset industry or financial services, and financial soundness. The SFC scrutinises both the individuals and the corporate structure behind the applicant.

Financial Requirements

Licensed VASPs must maintain minimum paid-up share capital of HK$5 million and liquid capital of at least HK$3 million (or one-twelfth of annual operating expenses, whichever is higher). VASPs must also maintain a reserve in the form of insurance or a cold wallet reserve covering client virtual assets.

Core Licensing Conditions

Retail Access

By default, VASP licences allow trading by professional investors only. A licensed VASP may apply to the SFC for permission to extend services to retail investors, subject to satisfying enhanced requirements around token due diligence, client suitability assessments, onboarding procedures, and token eligibility (only large-cap tokens meeting specified criteria may be offered to retail clients).

Custody of Client Assets

Licensed VASPs must maintain at least 98% of client virtual assets in cold storage. Hot wallet holdings are limited to 2% of total client virtual assets. VASPs must also maintain an insurance policy or similar arrangement to protect against losses from hot wallet holdings. Client assets must be held on trust and segregated from the VASP's own assets.

Token Admission and Due Diligence

VASPs must conduct thorough due diligence before listing any virtual asset for trading. The SFC has published detailed token admission criteria, covering smart contract audits, project team backgrounds, whitepaper disclosures, liquidity, market capitalisation, and token distribution. Certain categories of tokens (including those that qualify as securities under Hong Kong law) require additional regulatory approvals.

AML/CTF Obligations

Licensed VASPs are subject to the full AML/CTF regime under the AMLO, including customer due diligence (CDD), enhanced due diligence (EDD) for higher-risk customers, transaction monitoring, suspicious transaction reporting, record-keeping, and compliance with the Travel Rule for virtual asset transfers. The SFC has published detailed AML/CTF guidelines specifically for VASPs.

Prevention of Market Manipulation

Licensed VASPs must implement market surveillance systems to detect and prevent market manipulation, wash trading, and other forms of market abuse. They are required to maintain records of all trading activity and to cooperate with SFC investigations.

The Transition Framework

Exchanges that were already operating in Hong Kong before 1 June 2023 were eligible to apply under the transition framework, which allowed them to continue operating on a provisional basis while their licence application was being assessed. The transition period provided a runway for incumbents to meet the new regulatory requirements and submit compliant applications.

Exchanges that failed to apply during the transition window, or whose applications were rejected, were required to cease operations and wind down their Hong Kong business in an orderly manner. The SFC published guidance on wind-down requirements to protect client assets during the cessation process.

Ongoing Obligations of Licensed VASPs

Once licensed, VASPs are subject to ongoing SFC supervision, including regular audits, financial reporting obligations (including annual financial statements audited by an SFC-approved auditor), notification requirements for material changes to business (including changes to responsible officers, ownership, and technology systems), and cooperation with SFC inspections and investigations.

The SFC may impose conditions on a VASP licence, vary existing conditions, suspend, or revoke a licence if the VASP fails to meet ongoing requirements or engages in conduct detrimental to investors or market integrity.

Stablecoins and Other Developments

The VASP licensing regime focuses on virtual asset exchanges and does not, by itself, cover stablecoin issuers. Hong Kong has separately introduced a licensing regime for stablecoin issuers under the Stablecoins Ordinance, administered by the Hong Kong Monetary Authority (HKMA). VASPs that list or trade stablecoins must consider both the VASP licensing requirements and the stablecoin regulatory framework.

Update: what has changed since this guide was written

Hong Kong's virtual asset regulation moved substantially between late 2025 and mid-2026. The points below affect the analysis in this article and should be read alongside it.

• 3 November 2025. The SFC permitted shared order books with global affiliates, disapplied the twelve-month track record requirement for tokens offered only to professional investors and for HKMA-licensed stablecoins, allowed custody of tokens not admitted to trading and permitted distribution of products giving virtual asset exposure.
• 11 February 2026. Three circulars: margin financing by licensed corporations against Bitcoin and Ether collateral subject to a minimum 60% haircut; affiliated market makers on licensed platforms; and a framework for virtual asset perpetual contracts for professional investors.
• 10 April 2026. The HKMA granted the first two stablecoin issuer licences, to Anchorpoint Financial Limited and HSBC, from 36 applications. The first regulated Hong Kong dollar stablecoin, HKDAP, launched on 12 August 2026.
• 20 April 2026. The SFC established a framework for secondary trading of tokenised SFC-authorised investment products on licensed platforms, going beyond the primary dealing permitted under the 2023 circular.
• 27 May 2026. A joint HKMA and SFC circular gave HKMA-licensed stablecoins materially lighter treatment: licensed corporations may partner directly with the issuer for dealing and custody, the virtual asset knowledge assessment is disapplied for stablecoin-only services and the products are neither automatically complex nor restricted to professional investors.
• Four new licensing regimes are coming. Consultation conclusions on virtual asset dealing and custody were published on 24 December 2025 and on virtual asset advisory and management on 26 May 2026. All four will be implemented by amendments to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance and the Government has said it intends to introduce the bill during 2026. Unlike the 2023 trading platform regime, there will be no deeming arrangement so affected businesses cannot continue operating while an application is processed.

For the current position across all of these regimes, see our guide to Hong Kong crypto licence requirements. Separately, crypto-asset tax reporting obligations under the OECD framework begin on 1 January 2027 and reach a wider group of businesses than the licensing regimes do: see our guide to CARF in Hong Kong.

Conclusion

Hong Kong's VASP licensing regime represents a comprehensive, internationally-aligned framework for regulating cryptocurrency exchanges. For virtual asset businesses operating in or targeting Hong Kong, obtaining a VASP licence is both a legal requirement and a commercial necessity. The licensing process is rigorous, but a successful licence application provides a strong regulatory foundation and access to one of Asia's most significant virtual asset markets.

Alan Wong LLP advises virtual asset service providers on SFC licensing applications, regulatory compliance, and corporate structuring in Hong Kong. Contact us to discuss your VASP licensing needs.

To discuss how this affects your business, please get in touch.