Hong Kong Crypto Licence 2026 – SFC VASP Authorisation Guide

Overview

Why Hong Kong for Crypto?

Hong Kong's pivot to crypto regulation since 2022 is one of the most significant developments in global crypto policy. After years of restricting crypto access, the HKSAR government launched a comprehensive VASP licensing regime, positioning Hong Kong as Asia's leading regulated crypto hub alongside Singapore.

The regime, fully effective from June 2023, is mandatory for any platform operating a centralised virtual asset exchange serving Hong Kong clients. Unlike earlier opt-in frameworks, all VATPs must obtain SFC authorisation or cease operating. The SFC granted a transitional period for existing platforms operating before June 2023, with a deadline of 29 May 2024 for transitional arrangements.

Key advantages: zero capital gains tax, low territorial profits tax (16.5%), world-class financial infrastructure, proximity to mainland China markets (with important restrictions), and a bilingual (English/Chinese) legal system based on English common law.

Retail access unlocked

From June 2023, SFC-licensed VATPs may serve retail Hong Kong investors — a significant policy shift. Previously, crypto platforms could only access professional investors (HKD 8M+ portfolio). Retail access is subject to enhanced investor protection requirements including suitability assessments and token eligibility criteria.

Requirements

SFC VATP Licence Requirements

The SFC applies standards broadly equivalent to those for licensed securities brokers, adapted for virtual assets.

Hong Kong Substance

Must be incorporated in Hong Kong or a recognised jurisdiction with a substantive local presence. Board must include HK-resident responsible officers (ROs). No pure shell structures.

Responsible Officers (ROs)

Minimum 2 Responsible Officers — individuals approved by the SFC. ROs must have relevant financial/compliance experience and pass a fit-and-proper assessment. At least 1 must be active day-to-day.

Capital Requirements

HKD 5,000,000 (≈USD 640k) paid-up capital. Liquid assets ≥ 12 months of projected operating expenses at all times. Client assets must be segregated and held with licensed custodians.

AML/CFT Programme

Comprehensive AML/CFT policies compliant with HKMA and SFC guidelines. Travel Rule compliance (VASP-to-VASP transfers). MLRO with minimum 3 years relevant experience required.

Cybersecurity & Custody

At least 98% of client crypto assets in cold storage. Independent cybersecurity audit required annually. Insurance or equivalent financial backing for hot wallet assets.

Token Eligibility

Only tokens meeting SFC criteria may be listed for retail investors (currently limited to large-cap assets on approved indices). All new token listings require SFC pre-approval or compliance with published criteria.

Investor Protection

Suitability assessments for retail clients. Knowledge tests. Risk disclosures in Chinese and English. Cooling-off periods. Restrictions on leverage products for retail.

Business Continuity

Formal BCP/DR plan. Independent annual compliance audit. Regular reporting to SFC including financial returns, client asset reports, and incident notifications within 1 business day.

Step-by-Step Process

5 Steps to SFC VATP Approval

Weeks 1–8

Pre-Application Preparation

Engage Hong Kong legal counsel. Incorporate HK entity. Draft full suite of policies (AML, compliance, risk, cybersecurity, custody, token listing). Recruit and prepare Responsible Officers. The SFC expects near-final policies at submission — preparation is the longest phase.

Weeks 8–10

Pre-Submission Meeting with SFC

Optional but strongly recommended. SFC's Licensing Department will review your structure and flag issues before formal submission. Saves significant back-and-forth during formal review.

Weeks 10–12

Formal Application Submission

Submit via SFC's WINGS online system. Include: Form VA, business plan, financial projections, all policy documents, RO CVs and declarations, IT security assessment, and custody arrangements. Application fee: HKD 4,740.

Months 3–10

SFC Review & Due Diligence

SFC conducts detailed review including meetings with management, assessment of ROs, IT/cybersecurity audit review, and regulatory reference checks. Expect multiple rounds of questions and policy revisions. Maintain an internal project tracker for SFC queries.

Month 10–12

Approval & Licence Issuance

Upon satisfying all conditions, SFC issues the VATP licence. Conditions typically include: completion of independent cybersecurity audit, insurance confirmation, client asset segregation verification, and any outstanding staffing conditions.

Cost Breakdown

Hong Kong VASP Licence Costs (Year 1)

Excludes minimum capital of HKD 5,000,000 (~USD 640k). All figures in HKD unless noted.

Item	Low Est.	High Est.	Notes
SFC application fee	HKD 4,740	HKD 4,740	Non-refundable, paid at submission
SFC annual licence fee (VATP)	HKD 127,400	HKD 127,400	Payable upon approval, annually thereafter
Legal & compliance counsel	HKD 400,000	HKD 900,000	Application preparation, policy drafting
Responsible Officers (ROs)	HKD 600,000	HKD 1,500,000	Annual salary; 2 ROs minimum required
Compliance officer salary	HKD 400,000	HKD 800,000	MLRO / Head of Compliance
IT/cybersecurity audit	HKD 150,000	HKD 400,000	Annual independent audit required
Office & incorporation	HKD 80,000	HKD 200,000	Registered address + substantive office
Insurance (hot wallet)	HKD 100,000	HKD 500,000	Varies by AUM; can use alternative capital backing
Total Year 1 (excl. capital)	~HKD 1.7M	~HKD 4.4M	≈USD 220k–560k

FAQ

Frequently Asked Questions

A Virtual Asset Trading Platform (VATP) licence issued by the SFC under the AMLO. The regime became mandatory in June 2023. Any centralised exchange serving Hong Kong clients must hold this licence — there is no exempt category for offshore platforms actively marketing to Hong Kong users.

HKD 5,000,000 (approximately USD 640,000) in paid-up share capital. Additionally, the platform must maintain liquid assets sufficient to cover at least 12 months of projected operating expenses. These are ongoing requirements — capital must be maintained at all times, not just at the point of application.

9 to 12 months for a complete application from submission to approval, assuming no major deficiencies. The preparation phase (before submission) adds another 2–3 months, so total project timeline from engagement to licence is typically 12–15 months.

No. HK-licensed VATPs may not actively solicit or serve mainland China retail clients — China's ban on crypto trading applies regardless of the HK licence. However, mainland China institutional investors may access some products through proper channels. HK's value lies in serving HK-resident retail, global institutional, and Asian-Pacific clients.

Both are Tier-1 Asian crypto jurisdictions. Singapore MAS MPI requires SGD 250k minimum capital and takes 6–12 months; Hong Kong SFC requires HKD 5M and takes 9–12 months. HK has the advantage of 0% capital gains tax and access to HK retail clients. Singapore has a larger international fintech ecosystem. Many major exchanges hold both licences.

The total cost ranges from HK$500,000 to HK$2,000,000 depending on the licence type and scope of operations. This includes application fees (HK$50,000-HK$100,000), compliance setup costs, legal fees (typically HK$150,000-HK$300,000), and ongoing operational expenses. Additional costs apply if you require substantial infrastructure modifications or enhanced AML/KYC systems.

The standard approval timeline is 3-6 months from submission to final approval by the SFC. Initial assessment takes 4-6 weeks, followed by 2-3 rounds of clarification requests and due diligence review. Expedited processing is unavailable, though complete and well-prepared applications tend to receive faster approvals within the 3-month range.

Minimum paid-up capital requirements are HK$5,000,000 for a Type 1 (dealing in securities) or Type 7 (providing automated trading services) licence. For Type 4 (advising on securities), the minimum is HK$1,000,000. Capital must be held in a Hong Kong bank account and remain available for operational purposes.

Major banks accepting crypto-related accounts include HSBC, Hang Seng Bank, and Bank of China (Hong Kong), though most now require enhanced KYC documentation. Smaller banks like Fubon Bank and DBS Hong Kong have more flexible crypto-friendly policies. You should contact banks directly as policies change frequently; avoid relying on single-bank solutions.

You must appoint at least one full-time Compliance Officer with minimum 3 years' relevant experience and direct reporting to senior management. A Chief Executive Officer and Money Laundering Reporting Officer are mandatory. For larger operations, additional compliance staff may be required based on headcount and transaction volumes, typically 1 compliance officer per 50 employees.

The SFC does not maintain a whitelist, but you must conduct thorough assessment of each token's regulatory status and legitimate purpose before offering it. Tokens classified as securities require additional authorization, and tokens associated with sanctions, terrorism financing, or money laundering are prohibited. You must document your assessment framework and update it quarterly as regulations evolve.

Customer verification must comply with FATF Travel Rule standards and Hong Kong's AML Ordinance, requiring customer identification for transactions above HK$15,000. Enhanced Due Diligence is mandatory for high-risk customers and PEPs, with documentation retained for 5 years. Real-time transaction monitoring with automated alerts for suspicious patterns is mandatory for all licence holders.

Hong Kong's regulatory framework targets centralized operators; DEXs and fully decentralized protocols face legal uncertainty and generally do not require licensing if they have no Hong Kong operators or infrastructure. If you provide custody services or operate smart contracts from Hong Kong, you typically require a Type 4 or Type 1 licence. Hybrid models with some centralized elements trigger licensing requirements.

Professional indemnity insurance of minimum HK$3,000,000 is required for most licence types. Client assets must be segregated from operational funds and held with approved custodians or banks; commingled funds are prohibited. For digital asset custody, segregation must be recorded on-chain or with third-party proof, audited quarterly at minimum.

Annual licence fees to the SFC are HK$100,000-HK$300,000 depending on licence type and business volume. Ongoing compliance costs typically total HK$200,000-HK$600,000 annually, covering regulatory reporting, audits, and AML monitoring systems. Annual audits by external auditors cost HK$150,000-HK$400,000 depending on business complexity.

Staking and lending products may require a Type 4 (advising) or Type 9 (asset management) licence depending on how they are marketed and structured. If marketed as investment products with guaranteed returns, they trigger securities regulations requiring a Type 1 licence. You must obtain pre-approval from the SFC on product structure before launch; retroactive approval is not possible.

Breaches of licence conditions can result in fines up to HK$1,000,000 and licence suspension or revocation. False disclosures attract personal penalties for officers up to HK$500,000 and imprisonment. The SFC conducts unannounced audits; compliance violations discovered during audits typically result in enforcement action within 30-60 days of notification.

Compare Jurisdictions

Related Crypto Licences

Justice scales gavel law books — Hong Kong Crypto Licence: SFC VASP Authorisation 2026

◆ KEY REQUIREMENTS

Hong Kong Crypto Licence Overview

HKD 5,000,000

Minimum Capital Requirement

6-12 Months

Processing Timeline

HKD 250,000

Application Processing Fee

16.5%

Corporate Tax Rate

SFC

Regulator (Securities & Futures Commission)

Asia Hub

Strategic Regional Gateway

◆ APPLICATION PROCESS

Hong Kong Licence Timeline

Week 1-3

Initial Preparation & Documentation

Gather AML/KYC policies, compliance framework, financial statements, and corporate governance documents

Week 4-8

Formal Application Submission to SFC

Submit complete application package with HKD 250,000 processing fee and proof of capital deposits

Month 3-6

SFC Review & Clarification Requests

SFC conducts document review, requests additional information, and evaluates compliance readiness

Month 7-9

Onsite Assessment & Interview

SFC conducts office inspection, management interviews, and operational procedure verification

Month 10-12

Licence Issuance & Registration

Final approval granted, licence certificate issued, and VASP registration completed on SFC registry

Hong Kong Crypto Licence: SFC VASP Authorisation 2026