Hong Kong SFC VASP Licence: Application & Capital Requirements (2026)

Hong Kong relaunched as a regulated crypto jurisdiction on 1 June 2023 with the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance bringing Virtual Asset Trading Platform operators inside the Securities and Futures Commission perimeter. The regime is structurally distinct from MiCA, the UAE VARA framework, or Singapore's Major Payment Institution licence — Hong Kong treats virtual asset trading as an extension of securities and futures regulation under Type 1 and Type 7 regulated activities, with capital and conduct expectations close to the institutional broker-dealer end of the spectrum.¹^[1]

The SFC's posture is the most demanding in Asia. Capital floors of HK$5–10M (US$650,000–US$1.3M), Responsible Officer requirements modelled on the standard SFC RO regime, professional-investor restrictions softened only in 2024, and an authorisation timeline that runs 9–18 months from initial filing make Hong Kong materially more demanding than Singapore MAS or VARA. The strategic rationale for Hong Kong is proximity to mainland Chinese institutional money and the city's deep institutional broker-dealer ecosystem; the costs are commensurate.

This guide covers the Hong Kong VASP / VATP regime end-to-end: the legal architecture (AMLO + Securities and Futures Ordinance), the SFC Guidelines for Virtual Asset Trading Platform Operators, Type 1 + Type 7 combined licence, capital and liquidity requirements, the Responsible Officer regime, retail vs professional-investor distinctions, the Hong Kong Monetary Authority's parallel stablecoin issuer framework, costs and timeline, the political risk profile, and how Hong Kong compares to the EEA's Markets in Crypto-Assets Regulation framework, the Singapore Payment Services Act 2019, and the FATF Updated Guidance baseline applied across major regulators.²^[2]³^[3]⁴^[4]⁵^[5]⁶^[6]⁷^[7]

Hong Kong's VASP regime sits on two statutes operating together. The AMLO 2022 Amendment created the licensing perimeter for Virtual Asset Trading Platforms; the Securities and Futures Ordinance Cap. 571 provides the substantive regulatory regime for Type 1 (dealing in securities) and Type 7 (automated trading services) activities. A VATP licence is in practice a combined Type 1 + Type 7 licence with virtual-asset-specific overlays.

Every Hong Kong VATP must hold a combined Type 1 (dealing in securities) and Type 7 (automated trading services) licence under the Securities and Futures Ordinance. The combined licence is the structural basis on which all VATP-specific overlays sit. Operators that already held SFC licences for traditional securities activity (HashKey, OSL, Bullish, OKX entities) had a head start during the 2023–2024 transition; new entrants apply for the combined licence directly.

• Type 1 — dealing in securities. Authorises the platform to facilitate purchase and sale of cryptoassets treated as securities under SFO; layered onto the VATP perimeter, this becomes the basis for trading any in-scope cryptoasset.

• Type 7 — providing automated trading services. Authorises operation of the matching engine and the trading venue infrastructure itself.

• VATP overlay. SFC Guidelines impose VATP-specific requirements on top: token admission criteria, custody architecture, retail-investor protections, and market-manipulation surveillance.

The SFC Guidelines set the capital floor for a VATP at HK$5 million paid-up share capital plus HK$3 million in liquid capital — and the SFC routinely sets higher requirements for individual licensees based on activity scope, custody architecture, and projected client asset under custody.

Hong Kong's substance test runs through the Responsible Officer (RO) regime. Each VATP must appoint at least two Responsible Officers, both of whom must be SFC-approved, ordinarily resident in Hong Kong, fit-and-proper, and qualified to direct the regulated activity. The RO bar is materially higher than the comparable EEA NCA fit-and-proper bar — most successful candidates have prior SFC RO approval in adjacent securities activities.

• Two ROs minimum, both SFC-approved before licensing.

• Hong Kong residence, evidenced through tax residency, lease, and physical presence.

• Manager-in-Charge appointments for AML, custody, IT, risk management — typically 6–8 named individuals with documented Statement of Responsibilities.

• Local MLRO + Compliance Officer with Hong Kong residence and crypto-specific experience.

• Total senior compliance and governance headcount: typically 12–20 named individuals with documented SFC submissions for a retail-facing VATP.

The original 2023 SFC Guidelines restricted VATPs to professional investors only. The 2024 amendment opened retail access subject to additional protections — a material commercial shift that brought OSL and HashKey to retail trading and triggered a wave of new applications. Each retail VATP must satisfy enhanced retail-protection requirements that do not apply to professional-investor-only platforms.

VATP licensing runs in two formal phases: provisional / deeming-arrangement period, and substantive licensing. New applicants typically file under substantive licensing directly. Timeline 9–18 months from filing to grant.

• Phase 1 — Pre-application engagement (8–12 weeks). Confidential SFC engagement, business plan presentation, RO and MIC candidate scoping.

• Phase 2 — Application file submission. Type 1 + Type 7 + VATP-specific submission; substantial appendices on custody, AML, ICT, market integrity.

• Phase 3 — SFC substantive review (6–12 months). Multiple rounds of written questions; on-site visits; RO and MIC interviews.

• Phase 4 — Conditions and licence grant. SFC issues the licence subject to remaining conditions (capital deposited, premises, ICT audit completion).

• Phase 5 — Operational launch. Cutover to live customer service under the new licence; ongoing supervisory engagement begins.

A retail VATP authorisation programme runs US$3–8 million from decision to operational launch. The breakdown for a mid-sized exchange + custody applicant:

Fiat-referenced stablecoin issuance in Hong Kong is regulated separately by the Hong Kong Monetary Authority under the 2025 Stablecoins Ordinance. The HKMA regime applies to issuers of stablecoins referenced to fiat currencies; SFC-licensed VATPs that distribute or trade stablecoins fall under the SFC perimeter for those activities, but cannot themselves issue without HKMA authorisation.

• HKMA Stablecoins Ordinance applies from 2025; designated as a payment system regulator for stablecoin issuance.

• Reserve requirements: 100% reserves in high-quality liquid assets, segregated, daily reconciliation, monthly attestation.

• Hong Kong incorporation required; minimum capital materially above the VATP floor.

• Issuance restricted to HKD-pegged stablecoins initially; USD/EUR-pegged products case-by-case.

Founders choosing between Asia-Pacific options often frame Hong Kong against Singapore MAS Major Payment Institution and against the EEA's MiCA CASP.

• Underestimating the RO bar. SFC-approved Responsible Officers are scarce; most successful candidates have 8–15 years of SFC-regulated experience.

• Generic SFC submission. The SFC's Type 1 + Type 7 file format is detailed and prescriptive; AML programmes from MiCA / EEA templates are downgraded.

• Confusing AMLO with substantive conduct rules. The substantive regime is SFO + SFC Code of Conduct; AMLO is the licensing trigger, not the conduct rulebook.

• Ignoring the political risk profile. Hong Kong's institutional credibility has shifted since 2020; counterparties in Europe and the US apply enhanced due diligence on Hong Kong-incorporated CASPs.

• Treating retail and professional-investor regimes as interchangeable. Retail-facing requires materially more capital, custody segregation, marketing controls, and compensation arrangements.

9–18 months from substantive application filing to licence grant — among the longest in Asia. The clock is dominated by SFC review iterations and RO / MIC interview scheduling. Pre-application engagement (8–12 weeks) is mandatory in practice; SFC will not accept a substantive application without prior consultation. Plan a 14–22 month total programme from decision to operational launch.

Marginally. The SFC reviews fit-and-proper history including prior regulator approvals; MiCA CASP authorisation evidences regulatory experience but does not substitute for any element of the SFC application. The substantive file (capital, RO, custody architecture) is built fresh. Operators with both MiCA and SFC authorisation typically run them as parallel licences with shared compliance infrastructure.

HSBC, Standard Chartered, Wing Lung Bank, and select smaller institutions onboard SFC-licensed VATPs case-by-case. The diligence bar is at full institutional level — Type 1 + Type 7 licence holders pre-SFC's pivot benefited from existing relationships; new entrants face 6–12 months of banking diligence in parallel with the SFC application. Banking is the second-largest operational risk after the SFC review itself.

Commercially yes — institutionally yes — but with elevated due-diligence cost. EEA and US institutional counterparties, banks, and large asset managers conduct enhanced due diligence on Hong Kong-incorporated entities and may apply higher counterparty limits or refuse outright onboarding for some categories. The SFC's regulatory rigour remains best-in-class in Asia; the political risk profile is what changed. Build the capital and counterparty assumptions to reflect this.

No. Mainland China prohibits crypto trading by domestic residents; serving mainland customers from a Hong Kong VATP triggers material legal and operational risk in mainland China and SFC supervisory concern in Hong Kong. The SFC explicitly requires VATP geofencing and KYC controls to exclude mainland residents. Hong Kong VATPs serve Hong Kong residents and overseas (non-mainland) customers, with mainland-Chinese institutional money reaching Hong Kong via licensed asset managers, not direct retail.

Different perimeters under different regulators. SFC licenses Virtual Asset Trading Platforms — the venue where stablecoins (and other VAs) are traded. HKMA licenses fiat-referenced stablecoin issuers — the entity that mints and redeems the stablecoin. A firm operating both an exchange and an issuance business needs both authorisations from both regulators, with separate capital, governance, and substance requirements.

• EEA vs UK vs Offshore: Where to Incorporate Your Crypto Business: Which jurisdiction maximises regulatory access and tax efficiency

• UAE VARA Licence Guide: Application, capital, timeline, and ADGM FSRA comparison

• UK FCA Cryptoasset Authorisation Under PS23/6: The financial promotions regime and FSMA 2023 authorisation

• MiCA Compliance Guide for CASPs: Authorisation walkthrough — capital, governance, supplier stack

Hong Kong's VATP regime is the most demanding in Asia and one of the most demanding globally — capital, RO substance, ICT, and market surveillance combine into a programme that runs US$3–5M+ to authorisation. The strategic rationale is China-adjacent institutional money and a deep institutional broker-dealer ecosystem that no other Asian jurisdiction matches. The political risk profile has shifted since 2020 and EEA/US counterparties price it. For operators serving institutional Asian clients with appetite for the cost and the diligence overhead, Hong Kong remains commercially powerful. For everything else, Singapore MAS or VARA is usually the better answer.