The day the SFC approval lands is the day the easy part ends.<\/p>
A lot of founders treat the virtual asset trading platform licence as a finish line. You spent eighteen months and a fortune getting it, so it feels like one. The SFC sees it the opposite way. To the regulator, the licence is the moment you start being supervised, and the obligations that come with it run every day for as long as you hold it. In August 2025 the SFC published a custody circular that came straight out of an investigation into licensed platforms’ controls, an investigation that, in its own words, “revealed some inadequacies.” These were firms that had already passed the licensing bar. Holding the licence and meeting it are different jobs.<\/p>
Here’s the operational backbone the SFC actually expects once you’re live.<\/p>
The SFC does not supervise companies in the abstract. It supervises people, and it wants to know exactly which ones are accountable for what.<\/p>
You need at least two Responsible Officers, and they have to be and stay fit and proper, which the SFC tests on competence, financial soundness and reputation. Beyond that, the platform has to appoint a Manager-in-Charge for each of eight core functions, including overall management, risk, compliance, finance, IT and AML. An MIC has to be senior enough to actually decide things and has to report to the board. And the SFC treats the entire board as senior management, jointly responsible for both the platform and its custody entity.<\/p>
Three control functions have to exist and have to be independent of the people running the front office: compliance, risk management and internal audit. You also need a money laundering reporting officer. None of these can be a part-time hat worn by the COO. The SFC has said it expects, in most cases, more than one person on risk alone.<\/p>
If you under-hired during the application to keep the burn down, this is where it surfaces. Hiring your key personnel<\/a> properly, with the right seniority and genuine independence, is not an HR detail. It is a licensing condition, and a thin compliance bench is one of the first things an SFC inspection finds.<\/p> Your licence itself sits in Schedule 3B of the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), so it’s no surprise that anti-money-laundering work is the heaviest day-to-day load a licensed platform carries. The obligations run off the AMLO and the SFC’s AML guideline.<\/p> You run know-your-customer checks at onboarding and you keep monitoring, continuously, on a risk basis. You can’t outsource that monitoring to someone else and call it done. You screen against sanctions and terrorist lists before you onboard and before you transact. And when something looks wrong, you file a suspicious transaction report with the Joint Financial Intelligence Unit as soon as you reasonably can. There is no minimum value on that obligation. A HK$200 transaction that looks like layering gets reported the same as a HK$2 million one.<\/p> The travel rule is the piece people trip on. For virtual asset transfers at or above HK$8,000, you have to collect and pass on originator and beneficiary information, and because blockchain settlement is fast and final, the SFC expects you to do it before the transfer, not after. Build that into the rails from the start. Retrofitting it onto a live platform is painful.<\/p> If one area defines Hong Kong’s regime, it’s custody. The headline number is 98%. At least 98% of client virtual assets have to sit in cold storage, with no more than 2% in hot wallets, and exceptions only with the SFC’s specific permission. It’s among the highest cold-storage thresholds any major regulator imposes.<\/p> Client assets can’t sit on the trading company’s balance sheet. They have to be held on trust through an associated entity that is a wholly-owned, Hong Kong-incorporated subsidiary, holding a trust or company service provider licence, and doing nothing other than holding those assets. The assets are segregated, the client money goes into a segregated account at an authorised institution within a business day, and you carry a compensation arrangement covering 50% of the assets in cold storage and 100% of anything in hot storage.<\/p> Then there are the keys. Seeds and private keys have to be generated and stored securely, backed up, and kept in Hong Kong. No single person can hold the whole set. The SFC’s August 2025 circular on custody of client virtual assets (the “Custody Circular”) pushed this further: air-gapped signing devices, due diligence on your hardware security module provider, round-the-clock threat monitoring, continuous reconciliation between the chain and your ledger, and training so staff never “blind sign” a transaction they can’t read. The Custody Circular is the template the SFC intends to use for the coming custodian licensing regime<\/a>, so treat it as the floor, not the ceiling.<\/p> You don’t get to list a token because the desk likes it. The platform has to run a token admission and review committee, drawn from the people responsible for the business line, compliance, risk and IT, and it has to report to the board at least monthly. Its admission criteria have to be transparent, fair and published.<\/p> Every token gets due diligence before it goes live, covering the team behind it, its regulatory status, its liquidity and market risk, and the legal and money-laundering risks attached to the asset and its issuer. Smart-contract tokens need an independent audit. And if you want to offer a token to retail clients, the bar climbs: it has to be an eligible large-cap asset, included in at least two acceptable indices from at least two independent providers, and your retail clients have to pass a knowledge assessment before they trade.<\/p> The financial requirements don’t stop at licensing. You hold at least HK$5 million in paid-up capital, you keep liquid assets equal to at least twelve months of operating costs, held in something other than virtual assets, and you file monthly and annual returns. If your liquid capital drops below set thresholds, you tell the SFC straight away.<\/p> On systems, you run an annual technology audit, keep daily offline backups, and put a Responsible Officer in charge of the cybersecurity framework. On conduct, clients pre-fund their trades, you can’t run proprietary trading or market-making on your own book, you operate real market surveillance, and you handle complaints and conflicts through documented processes. The disclosures on your website, fees, listing criteria, audit links and client rights, aren’t marketing copy. They’re regulatory requirements. You also have a standing obligation to notify the SFC promptly of any material changes to your business, including key personnel changes, new products or services, and significant IT or cybersecurity incidents. This is an ongoing condition of the licence, not a one-time disclosure.<\/p> None of this is static. The SFC’s ASPIRe roadmap, published in February 2025, signals where the regime is heading. Staking became permissible in 2025, with SFC sign-off. In November 2025 the SFC let platforms share order books with qualifying overseas venues and dropped the old twelve-month track-record requirement for products offered to professional investors, which widened what you can list.<\/p> The bigger shift is coming. A bill to license virtual asset dealers and custodians is on its way to LegCo, and the proposed penalties for operating those services without a licence reach seven years’ imprisonment and a HK$5 million fine. The custody standards from the August 2025 circular will underpin it. If you hold a VATP licence today, parts of the regime you’ll be living under in 2027 are being written now.<\/p> Here’s the honest summary. The licence buys you the right to operate and the obligation to keep proving you should. The platforms that get into trouble aren’t usually the ones that failed the application. They’re the ones that passed it, then let the compliance backbone sag once the pressure was off.<\/p> That’s the work our virtual asset regulatory team<\/a> does after the licence is granted: keeping the governance, the custody arrangements and the corporate and compliance support<\/a> at the standard the SFC inspects against, not the standard that got you through the door. If you’re licensed and want a clear-eyed read on where your operation actually stands, book a consultation<\/a>.<\/p> This article reflects our understanding of Hong Kong law and applicable SFC and HKMA guidance as at June 2026. The regulatory framework for licensed virtual asset businesses is detailed and continues to develop. Nothing here is, or should be taken as, legal advice on any specific matter. For advice on your platform’s obligations, speak to a qualified Hong Kong solicitor.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" The day the SFC approval lands is the day the easy part […]<\/p>\n","protected":false},"author":2,"featured_media":5603,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","_vp_format_video_url":"","_vp_image_focal_point":[],"footnotes":""},"categories":[152],"tags":[],"class_list":["post-5593","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto"],"yoast_head":"\nAML and the travel rule: the part that never sleeps<\/h2>
Custody: the strictest rules in the room<\/h2>
Listing tokens: a committee, not a hunch<\/h2>
Money, systems and conduct<\/h2>
The regime is still moving, so keep watching<\/h2>