Hong Kong Virtual Asset Service Provider (VASP) Licensing Regime: Transitional Arrangements

Disclaimer: This article provides general information on Hong Kong’s virtual asset service provider licensing regime. It does not constitute legal advice. Consult a licensed solicitor for advice specific to your circumstances.

The clock is running for virtual asset service providers (VASPs) operating in or targeting Hong Kong. The Securities and Futures Commission (SFC) has confirmed that the transitional period for existing VASPs under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) (Cap. 615) will end on 1 June 2026. Any platform that does not hold a deemed licence or has not submitted a complete application by that date must cease operations in Hong Kong. This deadline represents a decisive shift from the temporary “deemed-to-be-licensed” status granted in June 2024. For compliance officers and prospective licensees, the next twelve months are not a grace period—they are a final window to meet statutory requirements or face enforcement action.

The Transitional Regime Under the AMLO

The current VASP licensing framework is governed by the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615), as amended by the Anti-Money Laundering and Counter-Terrorist Financing (Amendment) Ordinance 2022. This regime came into full effect on 1 June 2023.

Step 1: The Deemed-to-Be-Licensed Status

The SFC introduced a transitional arrangement for persons who were operating a virtual asset trading platform in Hong Kong before 1 June 2023. Under section 53ZRK of Cap. 615, these operators were automatically deemed to be licensed as VASPs from 1 June 2023 until the earlier of:

• The date the SFC grants or refuses the licence application; or
• 1 June 2024 (later extended to 1 June 2026 by the SFC in a 2024 policy announcement).

This deemed status allowed platforms to continue business while the SFC processed their applications. The SFC’s 2024 annual report (published July 2024) stated that 14 platforms had been deemed-to-be-licensed as of 30 June 2024. Another 10 applications were pending.

Step 2: The Application Window

To benefit from the transitional arrangement, an operator must have:

1. Been operating a virtual asset trading platform in Hong Kong before 1 June 2023; and
2. Submitted a complete licence application to the SFC before 29 February 2024.

Any operator that missed this window must apply for a licence under the standard pathway. The SFC has stated that it will not accept late applications under the transitional provisions.

Step 3: The 1 June 2026 Hard Deadline

The SFC’s extension of the transitional period to 1 June 2026 was announced in a circular dated 28 February 2024 (SFC/IS/031/2024). This extension applies only to deemed-to-be-licensed platforms that have already submitted a valid application. The SFC’s rationale was to allow adequate time for full compliance with the new regulatory standards, particularly the VASP Guidelines and the Code of Conduct.

After 1 June 2026, any platform that has not received a licence or has not been deemed to hold a licence must:

• Cease all virtual asset trading activities in Hong Kong; and
• Close its Hong Kong-based operations.

Regulatory Requirements for Licensed VASPs

Once licensed, a VASP must comply with a comprehensive set of statutory and regulatory obligations. These are set out in the SFC’s Guidelines for Virtual Asset Trading Platform Operators (the “VASP Guidelines”), issued under section 399 of the Securities and Futures Ordinance (Cap. 571) and section 53ZRZ of Cap. 615.

Licensing Conditions

Every VASP licence is subject to specific conditions imposed by the SFC. Standard conditions include:

• No retail clients: The platform may only serve professional investors (defined under Cap. 571, Schedule 1) unless the SFC grants a specific exemption.
• Custody of client assets: At least 98% of client virtual assets must be held in cold storage.
• Insurance coverage: The platform must maintain insurance or a compensation arrangement covering at least 50% of the value of client assets held in hot wallets.
• Audit requirements: The platform must appoint an SFC-approved auditor and submit audited financial statements annually.

The SFC’s 2023-2024 Annual Report (published July 2024) noted that the regulator had conducted on-site inspections of all deemed-to-be-licensed platforms. Several were found to have deficiencies in custody arrangements and internal controls.

Ongoing Compliance Obligations

Licensed VASPs must also comply with:

• Anti-money laundering (AML) and counter-terrorist financing (CTF) requirements under Cap. 615, including customer due diligence, record-keeping, and suspicious transaction reporting.
• Code of Conduct provisions under the SFC’s Code of Conduct for Persons Licensed by or Registered with the SFC, as applied to VASPs.
• Product offering rules: The SFC has indicated that it will treat certain virtual assets as “complex products” for the purposes of the Code of Conduct, requiring enhanced suitability assessments.

The SFC’s Enforcement Powers

The SFC has broad enforcement powers under Cap. 571 and Cap. 615. These include:

• Suspension or revocation of a licence for breach of conditions or the VASP Guidelines.
• Disciplinary action including fines and public reprimands.
• Criminal prosecution for unlicensed operation after the transitional period ends.

In April 2024, the SFC issued a public reprimand against a deemed-to-be-licensed platform for failing to maintain adequate systems and controls. This was the first such action under the new regime.

Practical Steps for Applicants and Compliance Officers

The SFC’s application process is rigorous. Compliance officers and prospective licensees should prepare thoroughly.

Step 1: Confirm Eligibility

The first step is to determine whether the applicant qualifies as a VASP under Cap. 615. The definition covers any person who operates a virtual asset trading platform in Hong Kong. A “virtual asset” is defined broadly and includes cryptocurrencies, stablecoins, and certain tokenised assets. The SFC’s 2022 Guidelines clarify that the definition excludes digital representations of fiat currency and certain closed-loop tokens.

Step 2: Prepare the Application

The application must be submitted through the SFC’s e-Application system. Required documents include:

• A business plan detailing the platform’s operations, target market, and risk management framework.
• AML/CTF policies and procedures.
• A custody policy and insurance arrangement details.
• Audited financial statements for the preceding two years.
• Personal information for all directors, controllers, and key personnel.

The SFC charges an application fee of HK$1,000,000 (as at 2025). This fee is non-refundable.

Step 3: Engage with the SFC

The SFC encourages early engagement. Applicants should:

• Request a pre-application meeting with the SFC’s Intermediaries Division.
• Submit a draft application for informal review before formal submission.
• Respond promptly to any queries from the SFC’s case officers.

The SFC’s target timeline for processing a complete application is six to nine months from the date of submission. However, complex cases may take longer.

Step 4: Prepare for On-Site Inspection

The SFC will conduct an on-site inspection of the applicant’s premises and systems. This inspection will test:

• Custody arrangements: Are client assets segregated and properly stored?
• AML/CTF controls: Are customer due diligence and transaction monitoring systems in place?
• IT security: Are the platform’s systems resilient against cyber attacks?

The SFC’s 2024 inspection findings (published in its annual report) highlighted that many applicants lacked adequate business continuity plans and incident response procedures.

The Road Ahead: 2025-2026

The next twelve months will be critical for the VASP licensing regime. Several developments are expected.

The SFC’s Enforcement Focus

The SFC has stated publicly that it will take a “zero tolerance” approach to unlicensed operation after 1 June 2026. In a speech on 28 February 2024, the SFC’s Deputy CEO, Ms. Julia Leung, warned that the regulator would “not hesitate to take enforcement action” against any platform that continues to operate without a licence.

Potential Legislative Changes

The government has indicated that it may introduce amendments to Cap. 615 to expand the scope of regulated activities. These could include:

• Stablecoin regulation: The Hong Kong Monetary Authority (HKMA) has proposed a separate licensing regime for stablecoin issuers under the Stablecoin Ordinance (Cap. 623) , which is expected to come into effect in 2025.
• DeFi and NFT regulation: The SFC has issued a consultation paper (2024) on the regulation of decentralised finance (DeFi) and non-fungible tokens (NFTs). The outcome may lead to further amendments to the VASP regime.

Market Reaction

The SFC’s licensing regime has already had a significant market impact. Several major global exchanges, including OKX and Gate.io, withdrew their Hong Kong applications in 2024, citing regulatory uncertainty. Conversely, HashKey Exchange and OSL have obtained full licences and are actively expanding their services.

The SFC’s 2024 annual report recorded that the number of licensed VASPs stood at 2 as of 31 March 2024. This number is expected to grow as the transitional period approaches its end.

Actionable Takeaways

1. If your platform is deemed-to-be-licensed, ensure your application is complete and responsive to SFC queries before 1 June 2026.
2. All new applicants must submit a complete application now—the SFC’s processing timeline of six to nine months leaves no room for delay.
3. Prepare for on-site inspections by auditing your custody, AML, and IT security systems against the VASP Guidelines.
4. Monitor the SFC’s enforcement actions and policy announcements closely—the regulatory landscape is evolving rapidly.
5. Engage legal counsel experienced in SFC licensing to navigate the application process and avoid common pitfalls.