Last reviewed: 14 August 2026

A VASP licence in Hong Kong is an SFC licence to provide a virtual asset service under section 53ZRK of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). In practice that means operating a virtual asset exchange. We run the application end to end: perimeter opinion, policies, personnel, external assessor, grant.

Most platforms hold that licence alongside an SFO Type 1 and Type 7 licence. On the SFC’s published lists as at 29 May 2026, thirteen platforms hold a licence, six applications are pending and seventeen entries sit on the returned, refused or withdrawn list. Founders rarely ask us what the rules are; they’re published, and most callers have read them. What they ask is who does what, in what order, and what to do when the regulator pushes back. The application is a construction project with a criminal statute at one end and a regulator inside your assurance engagement at the other. So this page is about the engagement, not the regime; where the rules matter, we link to the page that covers them.

Which activities trigger a licence under AMLO Cap. 615?

Operating a VA exchange does. Schedule 3B, Part 1, item 1 of the AMLO catches electronic facilities where offers to buy or sell virtual assets are regularly made or accepted “in a way that forms or results in a binding transaction”, or where persons are regularly introduced or identified to one another so that they may negotiate or conclude such sales or purchases, or where there is a reasonable expectation that they will. On that second limb the negotiating or concluding must itself be in a way that forms or results in a binding transaction, which is the part most summaries drop. Both limbs carry the same second condition: client money or client virtual assets must come into the provider’s possession, directly or indirectly. Section 53ZRB catches you too if you actively market such a service to the Hong Kong public, from here or anywhere else.

What we do. We write the perimeter opinion first, against the code, not the pitch deck. Limb (b), possession, is the gate. Who holds the keys? Who can move an asset without the client’s signature? Whose name is on the settlement account? Decks say “non-custodial” far more often than architectures do.

Then marketing. The SFC’s examples of packaging a service for the Hong Kong public include material in Chinese priced in Hong Kong dollars, so we read the landing page, the KOL contracts and the referral agreements. Where the answer is “not caught, on these facts”, we say so and set out what would change it. That answer has a shelf life. Consultation conclusions landed on dealing and custody on 24 December 2025 and on advisory and management on 26 May 2026; the Government has stated that it is finalising the legislative proposals and aims to introduce the relevant bill into the Legislative Council in 2026; the proposed regimes do not include a deeming arrangement. So a model outside the perimeter today may need a licence on the day a new regime commences, with nothing to carry it across. We put that in the opinion, with the date on it.

Where the answer is “caught”, we say from when. Operating without a licence is an offence under s.53ZRD, and the indictment tier alone carries a fine of HK$5,000,000 and 7 years’ imprisonment. Both scales, and the daily fines that run while the offence continues, are set out at which virtual asset licence you actually need.

Do you need a VASP licence, an SFO licence, or both?

Both, usually. The SFC calls it the Dual Licence Arrangement: securities are carved out of the AMLO definition of virtual asset, so a platform offering trading in security tokens needs Type 1 and Type 7 too, with dual licensing helping address regulatory and business-continuity risk if a token is later reclassified.

We fix the licence combination first, because it drives the rest of the matter. How many Responsible Officers you hire. Whether the Financial Resources Rules overlay applies. What happens the day a listed token changes character. Under VATP Guidelines para 7.12, a platform should cease to offer a reclassified virtual asset for trading by retail clients, and because compliance with the Guidelines is a standard licensing condition, treat that “should” as mandatory. Hold only the AMLO licence that day and you’re delisting mid-week with clients holding open positions.

So we build the classification framework your token admission committee runs on, with named owners for para 7.12 monitoring rather than a line in a manual. Then the arithmetic: two ROs will do if both are dually licensed, more than two if any is not.

What does a law firm actually do on a VASP application?

Less legal drafting than most founders expect, and far more sequencing. The sequence changed on 16 January 2025, when circular 25EC2 moved the external assessment from the front of the project to the end: applicants filing after 18 December 2024 build first and are assessed afterwards. Deemed-licensed platforms stay on the older 24EC65 track, where the Second-phase Assessment still has to be completed before the SFC lifts the conditions restricting their scope of business, so if that’s you, most of what follows describes a different file. The five stages, and what the SFC does at each one, are at the application process stage by stage.

Here’s what we produce, and where the pen sits.

Stage	What we produce	Pen
1. The bundle	P&P suite against the two named guidelines; RO competence files; the assessor RFP and capability pack; a mock SFC comment round before filing	We draft, you sign
2. SFC assessment	Comment responses, and remediation of the return list, which can include the SFC objecting to your assessor	Us, on your instructions
3. Full deployment	Vendor contracts for surveillance, AML/KYC tooling and custody; policies rewritten to match what was built; the change log	Your CTO and vendors; we specify and test
4. Tripartite agreement and assessment	The agreement, with terms and scope settled before the work starts; the project plan; responses to findings	The assessor reports; we hold your side
5. Findings, capital and grant	Remediation tracker; financial resources evidence pack; a review of the conditions the SFC proposes	Your finance team and us; the SFC decides

Where applications come apart. Usually at the bundle, and the same way each time: a policy suite bought with a systems vendor, lightly rebadged, filed. The SFC’s published grounds for returning an application include incomplete forms, unexplained “yes” answers on the fitness questions, thin information on the proposed business and operational workflow, and fewer than two apparently competent ROs with one fully competent. None of that is a legal question, which is why we read the bundle as the SFC would before it goes anywhere.

That mock round is the part clients push back on hardest, because it costs a fortnight nobody budgeted. It is also the cheapest fortnight in the project: a returned application means filing again into a process with no published deadline, and the fee does not come back.

Who picks the external assessor, and what is the tripartite agreement?

You do, and the SFC can stop it: if it opposes or has material concerns about your choice, it may return the application. The assessor is an independent professional accounting firm regulated by the Accounting and Financial Reporting Council, and the SFC signs the engagement alongside you, so an applicant expecting a private conversation about findings has misread it. The standards, the four eligibility criteria and who pays for what are at what an external assessment involves.

What we do. Assessor selection is a procurement exercise; the SFC made it one. We draft your request for proposal, score the responses against the four criteria in the SFC’s FAQ and stress-test independence. The awkward case is the firm that already audits you, or sold you the tooling it would be assessing. The RFP, the indication of interest and a capability statement covering any overseas affiliate personnel go into the bundle. Then the change log: material changes go to both the SFC and the assessor (25EC2, para 13), and on a live build there are more of them than anyone plans for.

Who can be a Responsible Officer, and how do the MICs fit?

A fifteen-person platform files with two Responsible Officers, and one of them owns Risk Management, Compliance and AML/CTF while also running Finance. Nobody set out to build it that way; the headcount arrived in that order. Expect to be asked about it, and have the answer ready before you are.

The formal requirements: two ROs at least, one ordinarily resident here, one an executive director, every executive director seeking RO approval, and at least one RO with not less than three years’ direct experience operating a VATP or providing automated trading services. Then Managers-In-Charge across eight core functions. Competence routes, CPT hours and personal exposure are at Responsible Officer requirements in full.

We build a competence file per candidate rather than a CV summary: examination passes, the extra CPT hours with dates, documentary proof of the experience claimed. Where a candidate is a technologist rather than a trader, we make the argument the SFC’s FAQ invites, that they were a key person in developing a technology central to the platform. We prepare the board resolutions and the MIC acknowledgements, then map the eight functions onto the headcount you actually have. RO approval is personal to the individual and carries personal regulatory responsibility, so we brief the individuals separately. Nobody should accept one without an indemnity in writing.

What do we do on custody, cold storage and AML?

The hard numbers belong to another page: cold-storage ratios, the compensation-arrangement percentages, the control standards in circular 25EC44 and the two-tier travel rule are all at ongoing obligations after grant. Our job is to build the thing those rules land on.

Corporate work comes first. Client assets can only be held on trust through an Associated Entity: a wholly owned Hong Kong subsidiary with a trust or company service provider licence, doing nothing else. We incorporate it, obtain the TCSP licence, file the notification under s.165 SFO and s.53ZRW AMLO, and draft the trust and client agreements so segregation works on paper and on chain. Then we test the build against 25EC44 line by line, with your CTO and your wallet provider in the room.

The compensation arrangement is the item most often left until last. In our experience it takes far longer to put in place than applicants plan for. Start it in the first month, not the week before the assessor arrives.

On AML, we draft the manual and the institutional risk assessment, build the counterparty due diligence framework, and paper the travel rule solution: that agreement has to allocate responsibility for the confidentiality and integrity of transmitted data and specify strong encryption, and most vendor paper does neither. One judgement we press on every applicant: outsourcing screening doesn’t outsource the obligation. Diligence the tool itself, its coverage, its accuracy, its blind spots on mixers, tumblers and privacy wallets. Put it in writing, because the assessor will ask.

What happens after grant, and what do you pay the SFC?

Reporting starts immediately and never stops: monthly returns, audited accounts, the annual return and fee, a seven-business-day clock on certain notifiable changes, and an independent firm’s first annual review within 18 months of approval. The deadlines, the thresholds and the surcharge ladder that ends in revocation are at what a licensed platform has to keep doing.

We build that calendar and the notification decision tree, and one named person has to own it, because the clocks don’t wait for a board meeting. Our test: can an operations manager at 9pm on a Friday work out, unaided, whether a system outage is a material service interruption requiring immediate notification? If they can’t, it isn’t finished.

On money, one distinction does most of the work. What the SFC charges are statutory fees payable to the regulator, prescribed by Schedule 3C to the AMLO for the VA service and by the Securities and Futures (Fees) Rules (Cap. 571AF) for Type 1 and Type 7, and charged separately under each applicable regime, with separate fees for the relevant corporate and individual applications and approvals. Separately, an annual fee of HK$4,740 per regulated activity (subject to any applicable waiver) and HK$4,740 for the VA service falls due within one month after each anniversary of the licence; that one recurs, and it is not an application fee. Pay via WINGS on acceptance, and if you withdraw before approval or refusal the application fee is not refunded. The item-by-item application fee schedule is in the application process stage by stage. The assessor’s fees are not statutory, and they fall on you.

Why hire a specialist firm for this?

Because the work is granular and it doesn’t stop. Months of drafting, sequencing, vendor negotiation and regulator correspondence, punctuated by decisions that have to be made the same day. Staff that with a rotating cast of associates and you file a bundle that reads like six people wrote it. The SFC reads bundles for a living.

We work as the legal back office for virtual asset businesses in Hong Kong: partner-led, a dedicated team on your file, no handover. The corporate work runs alongside the regulatory, so incorporation, the Associated Entity, shareholder approvals, employment contracts and visa timing for RO hires don’t go to a second firm halfway through the build. Licensing is one part of our wider crypto and virtual asset practice, which also covers token offerings, virtual asset funds, fraud and asset recovery, and regulatory investigations. We put commercial positions in writing, including that a business line isn’t worth what it costs to licence. And we’re candid about the calendar, which means telling you when the delay is yours.

Frequently asked questions

Do I need a VASP licence to run a crypto exchange in Hong Kong? If you operate a VA exchange here, or actively market one to the Hong Kong public from anywhere, yes. The Schedule 3B trigger turns on regularly forming binding transactions, or regularly introducing or identifying the people who go on to form them — including where there is only a reasonable expectation that they will — combined with possession of client money or client virtual assets. On either limb the transaction has to be a binding one.

How long does an SFC VASP licence application take? No processing deadline is published. The handbook lists ten factors that move the clock, from internal controls and the completeness of the bundle to capital injection, visa timing, how fast you answer the SFC and how many applications it is processing at the time. And since 25EC2 the assessment can’t begin until your systems are deployed and your policies match the build, so the build timetable sets the application timetable.

Do I have to choose the external assessor before I file? Yes. Documentation identifying a suitable assessor, its capability statement and your request for proposal go in with the bundle. The SFC can return the application if it opposes your choice.

Does this apply to a platform that has been deemed licensed since 2024? No. Circular 25EC2 is addressed to new corporations applying after 18 December 2024. Deemed applicants remain on the 24EC65 track, including the Second-phase Assessment under a tripartite agreement.

Can an overseas exchange get licensed without putting people in Hong Kong? No. The applicant has to be a Hong Kong company or an overseas company registered as a non-Hong Kong Company with the Companies Registry, at least one Responsible Officer must ordinarily reside here, and at least one must be an executive director. The SFC also assesses whether the business can actually be supervised from Hong Kong, and, in practice, a vehicle with no local function may have difficulty satisfying that requirement.

My site is in Chinese and prices in HKD, but my company is offshore. Am I caught? It’s a live question, and it turns on more than the website. Section 53ZRB(5) applies whether the marketing happens in Hong Kong or outside it, and the SFC’s FAQ gives Chinese-language, HKD-denominated material as one example of packaging a service for the Hong Kong public. But that is one of four non-exhaustive factors, alongside a detailed marketing plan, how extensively the service is advertised, and whether the campaign runs to a plan or schedule. We would want the whole marketing operation in front of us before giving a view.

Talk to us

Bring us the architecture diagram and the marketing site and we’ll tell you which side of the perimeter you are on. If the bundle is already with the SFC and the comments have started arriving, bring the correspondence instead. Book a consultation: one partner, one conversation, a straight answer on what the work involves.

This page is general information about Hong Kong law as at 14 August 2026. It is not legal advice and should not be relied on as such. The regulatory position for virtual assets in Hong Kong is moving quickly; please take advice on your specific circumstances.