Guide to Obtain a VASP License from the SFC in Hong Kong

Hong Kong offers a robust, high-standard licensing regime for Virtual Asset Service Providers (VASPs). Any entity providing virtual asset services in or actively marketing services to Hong Kong investors must be licensed and regulated by the Securities and Futures Commission (SFC). The framework is defined by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO), ensuring stringent investor protection and AML standards.

1. Legal Framework and License Type

The regulatory framework requires a license for two core activities, which may necessitate a dual license:

• • AMLO VASP License: Mandatory for all centralized entities carrying on a Virtual Asset Service (VASP activity) in or from Hong Kong. This is the overarching VASP requirement and covers non-security tokens.
• • Dual Licensing (SFO + AMLO): Required if the platform or entity deals in or provides automated trading services for virtual assets that are classified as "securities" (requiring Type 1 and Type 7 licenses under the Securities and Futures Ordinance (SFO)).

2. Corporate Structure and Financial Requirements

The SFC demands a locally incorporated entity with significant financial and operational substance.

• • Local Entity: Must be a company incorporated in Hong Kong (or an overseas company registered locally).
• • Local Substance: Establish a permanent local office and operations team.
• • Responsible Officers (ROs): Appoint at least two Responsible Officers who satisfy the SFC's "fit and proper" criteria. At least one RO must be ordinarily resident in Hong Kong, and at least one must be an Executive Director.

3. Application Preparation and Key Controls

The application requires detailed documentation proving operational and compliance readiness, applicable to all licensed VASPs.

• • External Assessment (Revamped): A mandatory single external assessment is required to be conducted by an independent professional accounting firm after the platform has implemented all its internal systems and controls. The assessment confirms compliance with the AMLO and SFO guidelines.
• • Cybersecurity & Custody: Mandatory for all custody services (safekeeping of private keys). Client VAs must be strictly segregated, and at least 98% of client VAs are expected to be held in cold storage.
• • AML/CFT: A comprehensive program covering KYC/CDD, on-chain surveillance tools, and compliance with the FATF Travel Rule requirements for crypto transfers.
• • Governance: Detailed organizational chart, risk management policies, internal audit program, and "fit and proper" declarations for all controllers and key personnel.

4. SFC Review, Approval, and Timeline

• • Submission: File the application through the SFC's online portal (WINGS), attaching all supporting documents and paying the non-refundable application fee (approx. HKD 4,740).
• • Review: The SFC conducts a thorough assessment including interviews with ROs/directors, technical due diligence, and supervising the External Assessment.
• • Conditional Approval: The SFC issues a Conditional Approval notice, contingent on finalizing external audits, staff hiring, and capital injection.
• • Estimated Timeline: The entire process, from application submission to final license grant, typically takes 6–9 months, depending on complexity and responsiveness.

5. Post-Licensing Compliance Obligations

VASP license holders are subject to strict and continuous compliance oversight.

• • Reporting: Submit monthly reports and annual audited financial statements.
• • AML Monitoring: Maintain ongoing AML monitoring and suspicious activity reporting.
• • Investor Protection: Implement investor protection measures, including conducting suitability assessments for retail clients (if applicable).
• • Notification: Timely notification of any material changes in ownership, control, or operations.

Official Portals

• • SFC Digital Assets Page:
  SFC Virtual Asset Trading Platform Operators
• • SFC Annual Licensing Fees:
  SFC Licensing Fees Information
• • SFC Guidelines for Virtual Asset Trading Platform Operators:
  SFC Guidelines