Crypto & Blockchain Regulation & Licensing in Hong Kong

Hong Kong operates one of the most developed and enforceable virtual asset regulatory frameworks in Asia. Businesses seeking to operate crypto exchanges, issue tokens, or provide blockchain-based financial services must obtain a licence from the Securities and Futures Commission (SFC) or comply with Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) requirements before commencing operations. Failure to do so exposes operators to criminal liability, forced cessation of business, and reputational damage that is difficult to reverse. This article maps the full regulatory landscape - from the legal basis and licensing pathways to practical compliance obligations, common mistakes of international entrants, and strategic alternatives for structuring a compliant Hong Kong crypto business.

Hong Kong';s crypto and blockchain regulatory framework rests on two primary legislative pillars. The Securities and Futures Ordinance (SFO), Cap. 571, governs virtual assets that qualify as "securities" under Hong Kong law. The Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), Cap. 615, as amended by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022, introduced a mandatory licensing regime for Virtual Asset Trading Platforms (VATPs) - commonly referred to as crypto exchanges.

The SFC is the primary regulator for virtual asset activities. The Hong Kong Monetary Authority (HKMA) oversees stablecoin issuers and payment-related blockchain activities, with a dedicated stablecoin licensing regime introduced through the Stablecoins Bill, which reached its final legislative stages in 2024-2025. The Customs and Excise Department and the Financial Intelligence and Enquiry Bureau (FIED) of the Hong Kong Police Force handle AML enforcement.

A critical distinction governs the entire framework: virtual assets that constitute "securities" - including tokens that represent equity, debt, or collective investment scheme interests - fall under SFO regulation and require a Type 1 (dealing in securities) or Type 9 (asset management) licence from the SFC. Virtual assets that are not securities - typically utility tokens and payment tokens - fall outside the SFO but are still subject to AMLO licensing if traded on a platform.

The 2022 AMLO amendments created a genuinely new category: the VATP licence. Under Schedule 3B of AMLO, any person who operates a virtual asset trading platform in Hong Kong, or actively markets such a platform to Hong Kong investors, must hold a VATP licence. This applies regardless of where the platform is incorporated. The extraterritorial reach of this provision catches many international operators who assumed that offshore incorporation provided a safe harbour.

In practice, it is important to consider that the SFC interprets "actively marketing" broadly. Maintaining a Chinese-language website accessible from Hong Kong, running targeted digital advertisements to Hong Kong IP addresses, or engaging Hong Kong-based introducing brokers can each trigger licensing obligations even without a physical presence in the territory.

The VATP licence is the central instrument for crypto exchange operators in Hong Kong. It is issued by the SFC under the AMLO framework and carries obligations that are substantially more demanding than equivalent licences in many competing jurisdictions.

To qualify for a VATP licence, an applicant must:

• Be incorporated in Hong Kong as a company limited by shares, or be a registered non-Hong Kong company with a principal place of business in Hong Kong.
• Have at least two Responsible Officers (ROs) approved by the SFC, each meeting fit-and-proper criteria including relevant industry experience, clean disciplinary records, and demonstrated understanding of AML/CFT obligations.
• Maintain a minimum paid-up share capital of HKD 5,000,000 and liquid capital of at least HKD 3,000,000 at all times.
• Hold client assets in segregated accounts with licensed financial institutions, with at least 98% of client virtual assets stored in cold wallets.
• Implement a comprehensive AML/CFT programme compliant with the SFC';s AML/CFT Guidelines and the Financial Action Task Force (FATF) Travel Rule.
• Appoint an SFC-approved external auditor to conduct annual financial and operational audits.

The application process involves submitting a detailed business plan, compliance manuals, IT security assessments, and biographical questionnaires for all ROs and substantial shareholders. The SFC typically takes six to twelve months to process a complete application. Incomplete submissions - a common mistake among international applicants - reset the clock and can add several months to the timeline.

A non-obvious risk is the "deemed licence" transitional arrangement. Platforms that were operating in Hong Kong before the VATP regime came into full effect on 1 June 2023 could apply for a deemed licence to continue operating during the transition period. That window has now closed. Any platform that did not apply during the transitional period and continues to operate without a licence faces immediate enforcement exposure.

The cost of obtaining a VATP licence is substantial. Legal and compliance advisory fees for preparing a complete application typically start from the low tens of thousands of USD. Ongoing compliance infrastructure - including AML systems, custody arrangements, and audit costs - adds further recurring expenditure. Operators should budget for a meaningful multi-year investment before the business generates regulated revenue.

To receive a checklist for VATP licence application preparation in Hong Kong, send a request to info@vlolawfirm.com

Where a virtual asset qualifies as a "security" under the SFO, a separate and parallel licensing regime applies. The SFC has published guidance confirming that tokens representing ownership interests, profit-sharing rights, or interests in collective investment schemes are securities for SFO purposes, regardless of the label applied by the issuer.

Dealing in security tokens requires a Type 1 licence (dealing in securities). Advising on security token investments requires a Type 4 licence (advising on securities). Managing portfolios that include security tokens requires a Type 9 licence (asset management). Each licence type carries its own capital requirements, conduct obligations, and ongoing reporting duties under the SFO and the Code of Conduct for Persons Licensed by or Registered with the SFC.

The SFC';s position on Initial Coin Offerings (ICOs) and Security Token Offerings (STOs) is clear: if the tokens being offered are securities, the offering must comply with the prospectus requirements under the Companies (Winding Up and Miscellaneous Provisions) Ordinance (CWUMPO), Cap. 32, or qualify for an exemption. The most commonly used exemptions are the professional investor exemption (offers made solely to professional investors as defined under the SFO) and the small offer exemption (offers to fewer than 50 persons within any 12-month period).

A common mistake made by international issuers is assuming that structuring a token as a "utility token" automatically removes it from securities regulation. The SFC applies a substance-over-form analysis. If a token grants holders economic rights that resemble those of a security - even if the white paper describes it as a utility token - the SFC may treat it as a security. This determination is fact-specific and requires careful legal analysis before any public offering or exchange listing.

Practical scenario one: a Singapore-based fund manager wishes to launch a tokenised real estate fund targeting Hong Kong professional investors. The fund tokens represent proportionate interests in a collective investment scheme. The manager must obtain a Type 9 licence from the SFC, comply with the SFO';s fund authorisation or exemption requirements, and ensure the token issuance complies with CWUMPO prospectus rules or a valid exemption. Operating without the Type 9 licence exposes the manager to criminal prosecution under section 114 of the SFO.

Practical scenario two: a European crypto exchange with no Hong Kong office begins accepting registrations from Hong Kong retail investors and lists several tokens that the SFC would classify as securities. The exchange is operating without a VATP licence and without SFC securities licences. The SFC can issue a public warning, seek a court injunction to block access from Hong Kong, and refer the matter for criminal prosecution - all without the exchange having a single employee in the territory.

AML/CFT compliance is not merely a licensing prerequisite in Hong Kong - it is an ongoing operational obligation with direct criminal consequences for failures. The AMLO imposes customer due diligence (CDD), record-keeping, and suspicious transaction reporting obligations on all licensed VATPs and SFC-licensed entities dealing in virtual assets.

The FATF Travel Rule, implemented in Hong Kong through the SFC';s AML/CFT Guidelines and the HKMA';s guidance for banks, requires VATPs to collect and transmit originator and beneficiary information for virtual asset transfers above HKD 8,000. This obligation applies to transfers between VATPs and, in certain circumstances, to transfers to unhosted wallets. The technical implementation of Travel Rule compliance requires integration with a Travel Rule solution provider - a cost and operational burden that many smaller operators underestimate at the application stage.

Under section 25 of the Organized and Serious Crimes Ordinance (OSCO), Cap. 455, any person who deals with property knowing or having reasonable grounds to believe it represents proceeds of an indictable offence commits a money laundering offence. For crypto businesses, this means that accepting deposits from wallets linked to sanctioned addresses, darknet markets, or known fraud schemes - even without actual knowledge - can trigger liability if the business failed to conduct adequate CDD.

The SFC conducts ongoing supervisory visits and thematic reviews of licensed VATPs. Deficiencies in AML/CFT controls are among the most frequently cited findings. Common deficiencies include inadequate enhanced due diligence for high-risk customers, failure to screen against updated sanctions lists in real time, and insufficient documentation of the rationale for accepting or rejecting customer relationships.

Many underappreciate the obligation to file Suspicious Transaction Reports (STRs) with the Joint Financial Intelligence Unit (JFIU). A licensed VATP that identifies a suspicious transaction but fails to file an STR within a reasonable time - typically interpreted as promptly upon forming the suspicion - faces regulatory sanction and potential criminal exposure under section 25A of OSCO.

To receive a checklist for AML/CFT compliance programme implementation for VATPs in Hong Kong, send a request to info@vlolawfirm.com

Stablecoin issuance represents a distinct regulatory category in Hong Kong, governed by the HKMA rather than the SFC. The Stablecoins Bill, introduced to the Legislative Council in December 2024, establishes a mandatory licensing regime for issuers of fiat-referenced stablecoins (FRS) - tokens pegged to one or more fiat currencies, including the Hong Kong dollar, US dollar, or euro.

Under the proposed framework, an FRS issuer must obtain a licence from the HKMA before issuing stablecoins in Hong Kong or marketing them to Hong Kong persons. The licensing conditions include maintaining a reserve of high-quality liquid assets equal to at least 100% of the outstanding stablecoin supply, holding reserves in segregated accounts with HKMA-approved custodians, and publishing monthly reserve attestations by an approved auditor.

The HKMA has indicated that unlicensed FRS issuance will be a criminal offence upon the Bill';s enactment. Issuers currently operating in Hong Kong or marketing to Hong Kong investors should assess their exposure immediately. The transitional arrangements under the Bill are expected to provide a limited window - likely six to twelve months from enactment - for existing issuers to apply for a licence or wind down Hong Kong operations.

A non-obvious risk for international stablecoin issuers is the interaction between the FRS licensing regime and the VATP licensing regime. A VATP that lists an unlicensed FRS may itself face regulatory action for facilitating unlicensed stablecoin activity. This creates a compliance dependency: exchanges must conduct due diligence on the regulatory status of stablecoins they list, not merely on the tokens'; technical characteristics.

Practical scenario three: a US-based fintech company issues a USD-pegged stablecoin and wishes to list it on Hong Kong-licensed VATPs to access Asian liquidity. Under the Stablecoins Bill framework, the company must either obtain an HKMA FRS licence or structure its Hong Kong distribution through a licensed intermediary in a manner that does not constitute "issuance" in Hong Kong. The legal analysis of what constitutes issuance in Hong Kong - particularly for tokens issued on public blockchains - is nuanced and requires jurisdiction-specific advice.

The SFC and HKMA have demonstrated a clear willingness to enforce the virtual asset regulatory framework. The SFC has issued public warnings against unlicensed platforms, sought court injunctions to freeze assets of suspected fraudulent crypto schemes, and referred cases for criminal prosecution. The HKMA has taken action against banks that failed to implement adequate controls for crypto-related transactions.

Criminal penalties under the AMLO for operating a VATP without a licence include a fine of up to HKD 5,000,000 and imprisonment for up to seven years. Penalties for SFO violations - including dealing in securities without a licence - include fines of up to HKD 10,000,000 and imprisonment for up to ten years. Civil penalties, including disgorgement of profits and market misconduct tribunal proceedings, add further exposure.

The risk of inaction is concrete: the SFC actively monitors crypto platforms accessible from Hong Kong and has the authority to issue restriction notices that freeze a platform';s operations within days of identifying a compliance breach. A platform that delays its licensing application while continuing to serve Hong Kong users accumulates enforcement exposure with each passing month.

A common mistake is treating the SFC';s public warning list as the primary enforcement signal. The SFC issues warnings as a consumer protection measure, but enforcement action - including criminal referrals - can proceed independently of whether a warning has been published. International operators should not interpret the absence of a public warning as regulatory tolerance.

Strategic risk management for international crypto businesses targeting Hong Kong involves several decision points. First, determine whether the business activity triggers VATP licensing, SFC securities licensing, or HKMA stablecoin licensing - or a combination. Second, assess whether the business can be structured to qualify for available exemptions, such as limiting services to professional investors only. Third, evaluate whether the compliance cost and timeline are commercially viable relative to the expected Hong Kong revenue.

The professional investor exemption under the SFO is frequently used by international operators to reduce regulatory burden. A platform that restricts access to "professional investors" as defined under Schedule 1 to the SFO - broadly, individuals with a portfolio of at least HKD 8,000,000 or institutions meeting specified criteria - may qualify for reduced conduct obligations. However, this exemption does not remove VATP licensing requirements under AMLO, which apply regardless of investor type.

Comparing alternatives: some international operators choose to serve Hong Kong investors through a licensed Hong Kong intermediary rather than obtaining their own licence. This arrangement - sometimes structured as an introducing broker or white-label relationship - transfers primary regulatory responsibility to the licensed intermediary but does not eliminate the international operator';s own obligations if it is deemed to be carrying on a regulated activity in Hong Kong. The legal characterisation of such arrangements requires careful analysis.

The business economics of the licensing decision are straightforward in principle but complex in execution. A VATP licence enables access to Hong Kong retail and institutional investors, partnerships with licensed banks and custodians, and the reputational benefit of SFC oversight. Against this, operators must weigh legal and compliance setup costs starting from the low tens of thousands of USD, ongoing annual compliance costs of a similar order, and the operational constraints imposed by the cold wallet, segregation, and audit requirements.

We can help build a strategy for entering the Hong Kong virtual asset market on a compliant basis. Contact info@vlolawfirm.com to discuss your specific situation.

What is the most significant practical risk for an international crypto exchange serving Hong Kong users without a licence?

The most immediate risk is criminal prosecution of the individuals responsible for operating the platform - not merely regulatory fines against the corporate entity. Under the AMLO, operating an unlicensed VATP is a personal criminal offence carrying up to seven years'; imprisonment. The SFC has demonstrated willingness to pursue individuals, including directors and senior managers of offshore entities, where those individuals are found to have directed unlicensed activity targeting Hong Kong investors. Beyond criminal exposure, the SFC can obtain court injunctions that effectively block the platform';s operations globally, not merely in Hong Kong. Reputational damage from a public SFC warning or enforcement action also affects relationships with banking partners and institutional counterparties in other jurisdictions.

How long does it realistically take to obtain a VATP licence, and what does it cost?

A realistic timeline from initial preparation to licence grant is twelve to eighteen months for a well-prepared applicant. The SFC';s formal review period is typically six to twelve months, but this assumes a complete and compliant application is submitted at the outset. Preparation of the application - including business plan, compliance manuals, IT security assessments, and Responsible Officer appointments - typically takes three to six months. Legal and compliance advisory fees for the full process start from the low tens of thousands of USD and can reach significantly higher for complex business models. Ongoing annual compliance costs - covering external audits, AML system licences, custody arrangements, and regulatory reporting - represent a recurring commitment that operators must factor into their financial projections from the outset.

Is it possible to serve Hong Kong professional investors without obtaining a VATP licence?

This is one of the most frequently asked strategic questions, and the answer is nuanced. The VATP licensing requirement under AMLO applies to any person who operates a virtual asset trading platform in Hong Kong or actively markets such a platform to Hong Kong investors, regardless of investor type. The professional investor exemption under the SFO reduces certain conduct obligations for SFC-licensed entities but does not create an exemption from VATP licensing. However, a platform that genuinely does not operate in Hong Kong and does not actively market to Hong Kong investors - and can demonstrate this through documented policies, geoblocking, and absence of Hong Kong-targeted marketing - may fall outside the VATP licensing trigger. The line between passive accessibility and active marketing is fact-specific. Operators relying on this distinction should obtain a formal legal opinion before proceeding, as the SFC';s interpretation of "actively marketing" has been broad in practice.

Hong Kong';s crypto and blockchain regulatory framework is comprehensive, actively enforced, and expanding. The VATP licensing regime under AMLO, the SFC';s securities licensing requirements for token-related activities, and the forthcoming HKMA stablecoin licensing regime together create a multi-layered compliance environment that demands careful planning before market entry. International operators who approach Hong Kong as an afterthought - or who assume that offshore incorporation provides protection - face material criminal and regulatory exposure. The commercially viable path is structured compliance: identifying the applicable licensing requirements early, building the compliance infrastructure in parallel with business development, and engaging with the SFC proactively rather than reactively.

To receive a checklist for assessing your crypto or blockchain business';s regulatory obligations in Hong Kong, send a request to info@vlolawfirm.com

Our law firm VLO Law Firms has experience supporting clients in Hong Kong on virtual asset regulation, VATP licensing, SFC compliance, and blockchain-related corporate matters. We can assist with licensing applications, AML/CFT programme design, regulatory risk assessments, and structuring advice for token issuances and exchange operations. To receive a consultation, contact: info@vlolawfirm.com