Hong Kong Crypto License: SFC VATP Regime (AMLO + SFO)

A Hong Kong crypto license is not a single permit. To run a centralised virtual asset trading platform (VATP), the Securities and Futures Commission (SFC) requires a dual authorization: a licence under the AMLO plus, where the platform trades virtual assets that are securities, Type 1 and Type 7 licences under the SFO. This regime has been mandatory since 1 June 2023.

If you operate a crypto exchange in Hong Kong, or actively market exchange services to the Hong Kong public, you are inside this regime whether you intended to be or not. This guide sets out exactly what the SFC VATP licence involves: the two statutes behind it, the HK$5,000,000 paid-up capital floor, the custody and insurance rules, who can trade which tokens, how to apply through WINGS, how long it realistically takes, and how the separate HKMA stablecoin regime sits alongside it. To see how Hong Kong stacks up against other routes, you can also compare crypto licence jurisdictions.

There is no single "Hong Kong crypto licence" (what the SFC VATP regime really is)

There is no standalone "Hong Kong crypto licence." A centralised virtual asset trading platform is regulated under a dual licensing arrangement: an AMLO licence to operate a virtual asset exchange, and, where the platform trades virtual assets that qualify as securities, SFO Type 1 and Type 7 licences. The SFC asks platforms to apply under both regimes through one consolidated online application. The regime has been mandatory since 1 June 2023 (SFC, Virtual asset trading platform operators).

The qualifier in this page's title, "SFC VATP regime," is the key disambiguator. When founders search for a Hong Kong crypto license, the canonical answer is the SFC's VATP framework. It is named, it is dual-statute, and it is the legal gateway to running a licensed exchange in the territory.

SFC vs HKMA: two regulators, two regimes

Two Hong Kong regulators touch crypto, and they must not be confused. The Securities and Futures Commission (SFC) licenses and supervises VATP operators under the dual AMLO + SFO arrangement (SFC). The Hong Kong Monetary Authority (HKMA) is a separate regulator for fiat-referenced stablecoin issuers under the Stablecoins Ordinance (HKMA, Regulatory Regime for Stablecoin Issuers).

In short: if you run an exchange, your regulator is the SFC. If you issue a fiat-referenced stablecoin, your regulator is the HKMA. The two regimes are explained separately below so you can see where your business model sits.

Who needs a VATP licence

The trigger is broad. Operating a centralised VATP in Hong Kong, or actively marketing such services to the Hong Kong public, without a licence is an offence (SFC). Active marketing matters as much as a local server: an offshore platform that targets Hong Kong users can fall within the regime. If your business plan touches the Hong Kong public and involves a centralised order book or trading venue for virtual assets, assume you need to be licensed and confirm scope early.

Which licences a VATP must hold: AMLO and SFO Type 1 / Type 7

A VATP holds a combination of authorizations rather than a single licence. The AMLO licence covers operating a virtual asset exchange. The SFO Type 1 (dealing in securities) and Type 7 (automated trading services) licences apply where the platform trades virtual assets that are securities (SFC). Because a single token can move between security and non-security status, the SFC recommends applying under both regimes at once. This is also why VATP work overlaps so closely with broader exchange licensing in Hong Kong and elsewhere.

AMLO regime (Cap. 615)

The AMLO is the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (Cap. 615). Its VATP licensing regime has been in effect since 1 June 2023, and from that date any operator of a virtual asset exchange in Hong Kong must be licensed (SFC; SFC, Lists of virtual asset trading platforms). The AMLO licence is the foundation: it captures the exchange activity regardless of whether the listed tokens are securities.

SFO regime (Cap. 571): Type 1 and Type 7

The SFO is the Securities and Futures Ordinance (Cap. 571). Where the platform trades virtual assets that are "securities," it must hold Type 1 (dealing in securities) and Type 7 (automated trading services) licences in addition to the AMLO licence (SFC). Type 1 captures the dealing function, Type 7 captures the automated matching engine. A platform listing security tokens therefore needs the full stack.

Why platforms apply under both regimes

Token classification is not static. A virtual asset can be treated as a security at one point and as a non-security at another, depending on its structure and use. To avoid being caught out by a reclassification, the SFC advises platforms to apply under both the SFO and AMLO regimes via a single consolidated online application so they remain compliant either way (SFC). In practice almost every serious exchange applicant takes the dual route.

Capital and financial-resources requirements for an SFC VATP licence

The SFC VATP capital test has three layers: a fixed paid-up share capital floor of HK$5,000,000, a liquid-capital calculation under the Securities and Futures (Financial Resources) Rules with monthly returns, and a working-capital buffer of liquid assets equal to at least 12 months of operating expenses. The paid-up capital must be maintained at all times (SFC Guidelines for Virtual Asset Trading Platform Operators; O'Melveny analysis).

Paid-up share capital: HK$5,000,000 at all times

The headline figure is a paid-up share capital of not less than HK$5,000,000, held at all times rather than only at the point of application (SFC Guidelines; O'Melveny). If the platform is ever unable to maintain its paid-up or liquid capital, it must notify the SFC as soon as practicable. This is a continuing obligation, not a one-off gate, so capital planning has to assume the floor holds through the whole licensing life.

Liquid capital and monthly financial returns

Beyond the fixed floor, the platform must comply with the Securities and Futures (Financial Resources) Rules, calculating liquid capital and required liquid capital and submitting monthly financial returns to the SFC (SFC Guidelines). On top of this, it must hold liquid assets in Hong Kong equal to at least 12 months of operating expenses (O'Melveny). For a first-year operator, this 12-month runway requirement is often the larger number to fund.

How licensed platforms must hold client crypto (custody rules)

Custody is one of the most prescriptive parts of the regime. Client virtual assets cannot sit on the operator's own balance sheet; they must be held through an associated entity, in segregated and platform-designated wallets ring-fenced from the operator's own assets, with 98% of client virtual assets in cold storage and no more than 2% in hot wallets (O'Melveny).

Associated-entity custody and segregation

Client virtual assets must be held through an associated entity of the platform operator, in segregated, platform-designated wallets that are ring-fenced from the operator's own assets (O'Melveny). The associated-entity structure puts custody at arm's length from the trading operation, so that an operator's own financial trouble does not pull client assets into the estate. Building this entity correctly, with the right governance and banking, is one of the heaviest pieces of the application.

The 98% cold / 2% hot storage split

The split is exact: at least 98% of client virtual assets must be held in cold storage, and no more than 2% may be kept in hot wallets (O'Melveny). The 2% hot ceiling forces a deliberate liquidity-versus-security trade-off in how withdrawals are serviced, and it has direct knock-on effects on the insurance arrangement covered next.

Client-asset insurance and compensation arrangement

A licensed VATP must put a compensation arrangement in place to cover the potential loss of client virtual assets. The coverage scales with where the assets sit: at least 100% coverage for assets in hot storage and at least 50% for assets in cold storage. The arrangement can be built from third-party insurance, demand or time deposits with a maximum six-month maturity, trust-held virtual assets, or Hong Kong bank guarantees (O'Melveny).

The logic mirrors the custody split. Hot-wallet assets are the more exposed, so they demand full 100% coverage; cold-storage assets carry a lower (but still substantial) 50% floor. Because true crypto insurance capacity is limited and expensive, most applicants assemble a blend of the eligible instruments above rather than relying on a single insurer.

Which tokens retail investors can trade (token admission and due diligence)

Retail investors can trade crypto on licensed Hong Kong platforms, but only a narrow band of tokens qualifies. Tokens offered to retail must be non-security, highly liquid and large-cap, and must be included in at least two acceptable indices issued by at least two independent index providers (IOSCO-aligned), with at least one provider having virtual-asset-market experience (O'Melveny).

The platform must conduct due diligence before admitting any token and on an ongoing basis afterwards, so a token can be de-listed if it stops meeting the criteria. Stablecoins are excluded from retail trading pending their own regulatory regime, which is the HKMA-administered Stablecoins Ordinance discussed below (O'Melveny). The two-index large-cap rule is a meaningful constraint on any platform whose commercial plan depends on listing long-tail or newly launched tokens for retail users.

Fit-and-proper persons and the two-phase external assessment

Two governance gates sit at the centre of the regime. First, the applicant, its substantial shareholders, directors and responsible officers must all be fit and proper, judged on competence, reputation, financial integrity, and awareness of regulatory and ethical standards (O'Melveny). Second, independent external assessors must evaluate the platform's policies, systems and controls in two reports: a Phase 1 report before licensing and a Phase 2 report after licensing (SFC; O'Melveny).

The external assessment is not a formality. It examines whether the controls actually work, not just whether they exist on paper, and the two-phase structure means scrutiny continues after the licence is granted. Preparing for Phase 1 (and remediating what the assessor flags) is one of the main reasons the timeline runs long.

How to apply: WINGS, fees and the application process

A VATP applies through a single consolidated online application covering both the SFO and AMLO licences, submitted via the SFC's WINGS (WINGS-LIC) portal. The application fee is HK$4,740 per regulated activity for a licensed corporation, and the SFC publishes a VATP Licensing Handbook and FAQs that set out the procedures and ongoing notification obligations (SFC; SFC, Regulatory requirements).

The HK$4,740 per-regulated-activity figure is only the filing fee. It is not the cost of getting licensed: the real spend sits in capital, the associated-entity custody build, external assessors, legal and compliance staffing, and the long internal runway. We do not publish a price list because every engagement is scoped to the platform's model and the regulated activities involved.

Ongoing obligations after licensing

Licensing is the start of a continuing compliance programme, not the end of it. A licensed VATP must maintain safe custody of assets, robust KYC, an AML/CFT framework, conflict-of-interest avoidance, market-manipulation and market-abuse prevention, proper accounting and auditing, risk management and cybersecurity (SFC, Regulatory requirements). The monthly financial returns and the Phase 2 external assessment fold into this same continuing-obligation picture.

Timeline: how long an SFC VATP licence takes (and the deeming arrangement)

There is no fast track. The timeline is long, driven by fit-and-proper vetting, the two-phase external assessment and the SFC's own review. Several operators were licensed only in late 2024 or 2025, well over a year after applying (SFC, Lists of virtual asset trading platforms).

For pre-existing platforms that were already operating in Hong Kong before 1 June 2023, a transitional "deeming" arrangement applied. They had to submit a licence application by 1 December 2023 to qualify for deemed-licence treatment. Platforms that did not apply had to cease Hong Kong operations by 31 May 2024, while those with pending applications could continue under the deeming arrangement (O'Melveny). New entrants today do not benefit from deeming; they apply cold under the full regime.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

The HKMA stablecoin regime (separate from the VATP licence)

Stablecoins sit under a separate regime administered by the HKMA, not the SFC. The Stablecoins Ordinance has been in operation since 1 August 2025 (HKMA; Morgan Lewis analysis). It initially captures fiat-referenced stablecoins (FRS): anyone who issues an FRS in Hong Kong, or who issues an FRS pegged to the Hong Kong dollar anywhere, must, unless exempt, be licensed by the HKMA (Morgan Lewis).

The core requirements are: a minimum paid-up share capital or financial resources of HK$25 million (or equivalent, or other HKMA-approved resources); full backing of each stablecoin by high-quality, highly liquid reserve assets, segregated by stablecoin type; and a redemption right for holders without unduly burdensome conditions or unreasonable fees (Morgan Lewis). Parties that considered themselves ready were invited to apply to the HKMA by 30 September 2025, with the first batch of licences expected in early 2026 (Morgan Lewis). If your business is issuing a stablecoin rather than running an exchange, this is your route, and our overview of licensing for stablecoin issuers explains how it compares globally.

Who is licensed to operate a crypto exchange in Hong Kong today

The licensed population is small. The SFC's public list shows roughly a dozen formally licensed VATPs (SFC, Lists of virtual asset trading platforms). The exact count and identities change as new licences are granted, so the live SFC list is the only reliable reference at any given moment, and it should be checked rather than relying on a static figure.

A short licensed list is itself a signal: the bar is high, the process is demanding, and a Hong Kong VATP licence carries real weight with banks, counterparties and institutional users precisely because it is hard to get.

Hong Kong vs other crypto-licensing jurisdictions

Hong Kong's SFC VATP route is one of several mature Asia-Pacific and global options, and the right choice depends on your model, your tokens and your target users. The headline distinctives of Hong Kong are the dual AMLO + SFO structure, the HK$5,000,000 paid-up capital floor, the prescriptive 98/2 custody split, and the narrow large-cap two-index retail token rule.

For a closer look at the peer routes, see Singapore's MAS DPT licence, UK FCA registration, and Switzerland's FINMA route. We have kept the comparison qualitative where each jurisdiction's exact figures live in its own guide rather than quoting cross-jurisdiction numbers here, so each route is read against its own primary sources.

What's next: proposed VA dealer, custodian and advisory regimes

Hong Kong's framework is still expanding. Beyond the VATP and stablecoin regimes, the authorities have signalled further regulation of virtual asset dealers, custodians and advisory or asset-management activities, through consultations and a broader policy roadmap. These proposals are not yet law and should be treated as a watch item rather than an enacted requirement. If your model includes custody-as-a-service, OTC dealing or advisory work, it is worth tracking these developments and our crypto regulation news and analysis follows them as they firm up.

How Crypto Valley Partners helps you secure a Hong Kong VATP licence

Crypto Valley Partners AG is based in Zug, Switzerland, in the heart of Crypto Valley, and advises operators and founders on choosing and securing the right crypto licence across jurisdictions. For Hong Kong, that means structuring the dual AMLO + SFO application, building the associated-entity custody arrangement to the 98/2 standard, preparing for the fit-and-proper review and the Phase 1 external assessment, and scoping the capital and 12-month runway before you file through WINGS.